The Telegram Android Flaw: A Look At The Call Attack Concern

🔍 Read the full analysis: The Telegram Android Flaw: A Look At The Call Attack Concern on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get everyday essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram for Android on October 29, saying an attacker could use it as part of a chain of bugs to take control of a phone after its owner answered an incoming call. The company says Telegram fixed the relevant call-code issue in version 12.10.4, released in late September; the full chain and its potential impact have not been independently established in a public technical write-up.

NebuSec says the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, a range spanning March 2022 to September 2026. Its chief executive, Eten Zou, told The Hacker News that the call-code flaw alone was not sufficient for a takeover. According to Zou, an attacker would also need to use a second bug to escape the app into Android, followed by a third vulnerability that provided root, or administrator-level, access.

NebuSec says the attack required the target to answer an incoming call, making it a one-click scenario rather than an attack that works without any action from the recipient. The company says it tested the chain in private voice calls on ARM64 phones, a processor architecture used by most modern Android phones. Its October 29 demonstration video shows a call connecting before the victim phone returns to its home screen, but the video does not identify the Telegram or Android versions used.

The underlying call-code change is visible in Telegram’s public Android source, according to the source material. In version 12.10.3, the code checked whether a camera-rotation field existed but then read a separate video-state field that might be absent. Version 12.10.4 reads the rotation field instead. That code comparison supports the existence of a change, but it does not by itself verify NebuSec’s claims about the two additional bugs or the complete takeover chain.

Why Answered Calls Raise Risk

Calls are a feature designed to accept data from another account as soon as a connection begins. That makes call-handling code a potential attack surface, including when the person receiving the call has not yet decided whether to trust the caller. In this case, NebuSec says the target had to answer, so the described route depends on a user action rather than silently compromising a phone.

The report matters most to people using older Android versions of Telegram and to organizations managing work phones. Updating to 12.10.4 or later addresses the call-code issue identified in the report. Until a device is updated, Telegram’s call privacy setting can be restricted to contacts or nobody, and users can decline calls from unfamiliar accounts. Those steps reduce exposure to calls from strangers but do not establish that every related risk is blocked.

For security teams, the absence of a CVE identifier may complicate monitoring: systems that rely only on CVE feeds may not flag this report. Organizations can apply a minimum app-version policy and set rules for approved messaging apps. Those measures are sensible responses to the reported issue, but the available information does not show that businesses have been targeted through it.

Products Worth Considering

DJI Osmo Pocket 3 Creator Combo Vlogging Camera with Mic 2, 1 CMOS, 4K/120fps, 3-Axis Stabilization, 128GB Card

AmazonView Latest Price

DJI Osmo Pocket 3 Vlogging Camera with 1-Inch CMOS Sensor and 4K Video

AmazonView Latest Price

Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates Public Disclosure

NebuSec says it reported the flaw to Telegram on September 26, shortly after version 12.10.4 became available. Zou told The Hacker News that Telegram acknowledged the report but did not consider the bug capable of remote code execution. According to Zou, no CVE was assigned and no bounty was paid. The source material reports no public response from Telegram as of October 29.

A review of Telegram’s public code described in the source material found that a shared call library used across its apps received the same correction on April 21, 2026, in a change titled “Fix camera rotation.” The Android code containing the correction appeared later, in version 12.10.4. The Hacker News reported that iOS received the change in May and desktop in July, but the available reporting does not establish whether those platforms were exploitable.

As of October 29, the flaw had no CVE listing in the U.S. National Vulnerability Database, and the CISA catalog of known exploited vulnerabilities had no Telegram entry. NebuSec says it has not seen real-world attacks. These are limited indicators: the lack of a listing or observed attack does not prove that the bug was never exploited.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

What the Public Evidence Shows

The full attack chain remains unverified in a public technical report. NebuSec’s short video does not show the software versions involved, and its research page reportedly did not contain a detailed write-up on October 29. The second app-escape bug and the third root exploit have not been independently checked in the material provided.

It is also unclear whether the chain works against a current, fully patched Android device, whether anyone exploited the flaw before disclosure, or whether older versions of Telegram on iOS or desktop could be affected by related code. NebuSec says it has no evidence of real-world attacks; that means the company has not observed them, not that exploitation can be ruled out. The source material also reports no direct public statement from Telegram about the report.

Update and Monitor Telegram

Android users should check the version displayed in Telegram’s Settings and update to 12.10.4 or later. If an update is not yet available for a device, users can limit incoming calls through the “Who can call me?” setting and avoid answering calls from unfamiliar accounts. App-version labels and rollout timing can vary, so users should verify that the update has installed rather than relying only on an update prompt.

Security teams should identify devices running earlier Telegram versions and set a minimum permitted version for work phones. Further clarity depends on Telegram’s public response, any detailed technical disclosure from NebuSec, and evidence about the other bugs in the claimed chain. Until that information is available, the confirmed code correction and the unverified takeover claim should be treated separately.

Key Questions

What is the reported Telegram Android flaw?

NebuSec says a bug in Telegram’s Android call code could be used as part of a larger attack chain. The company says an attacker would need two additional bugs to escape the app and gain control of the phone.

Does the attack work without answering a call?

According to NebuSec, the target had to answer the incoming call. That makes the reported scenario a one-click attack, not a zero-click attack.

Which Telegram version contains the fix?

The source material identifies Telegram for Android 12.10.4 as the version containing the fix. Users should update to that version or a later release.

Has the flaw been used in real-world attacks?

NebuSec says it has not seen real-world attacks. The available information does not independently establish whether exploitation occurred before the disclosure.

Are Telegram on iPhone and desktop affected?

The source material does not establish that either platform was exploitable. It reports that related code received a correction in iOS and desktop releases, but whether the older code could be exploited there remains unknown.

Source: ThorstenMeyerAI.com