🔍 Read the full analysis: How The Telegram Android Flaw Relates To Answering A Call on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
NebuSec disclosed an Android Telegram call-code flaw on October 29, 2026, and says it could be chained with two other bugs to take control of a phone after the user answered a call. Telegram’s Android version 12.10.4 contains the relevant fix, but the full attack chain has not been independently verified and NebuSec says it has seen no real-world attacks.
Security startup NebuSec disclosed a Telegram for Android flaw on October 29, saying an attacker could use it as part of a chain that takes control of a phone after the recipient answers a call. The relevant call-code bug is fixed in Telegram Android version 12.10.4, released in September, but the complete exploit chain has not been independently documented in a public technical report.
NebuSec says the call-code bug was one part of a three-bug chain. According to the company’s chief executive, Eten Zou, the call flaw combined with a second bug that leaked information to help an attacker escape Telegram’s app boundaries. A third vulnerability affecting Android then allegedly gave the attacker root access, or administrator-level control of the device. NebuSec said the attacker needed an ordinary Telegram account and that it tested the chain on private voice calls using ARM64 phones.
The company reported the issue to Telegram on September 26, shortly after version 12.10.4 appeared, Zou told The Hacker News. Zou said Telegram acknowledged the report but did not consider the bug capable of enabling remote code execution. He also said no CVE number was assigned and no bug bounty was paid. The Hacker News sought Telegram’s comment; the source material says no public response had been found as of October 29.
The source’s review of Telegram’s public Android code compared versions 12.10.3 and 12.10.4 and found a change in how the call software reads a video-rotation value from a status message. In the older code, it checked that one field existed but read a different field that might be absent. The newer version reads the checked field. That code change supports the existence of a bug in the call handling path; it does not, on its own, verify that the full chain described by NebuSec worked as claimed.
Infographic 01 · Telegram for Android
One tap on “answer”, three bugs, one fix.
What is confirmed, what rests on NebuSec’s word, and what nobody knows yet about the voice-call flaw fixed in Telegram for Android 12.10.4.
- The callAn ordinary Telegram account calls the victim
- The tapThe victim answers. Without this, no attack
- Bug 1Call code misreads a status message (MediaState)
- Bug 2An information leak helps break out of the app
- Bug 3An Android root exploit: messages, mic, camera
Chain as described by NebuSec’s CEO to The Hacker News. Bugs 2 and 3 are not public; no technical write-up exists yet.
- The bug and the fix match in Telegram’s public source (12.10.3 vs 12.10.4)
- Same correction in the shared call library on 21 Apr 2026, titled “Fix camera rotation”
- No CVE in the US vulnerability database (29 Oct)
- No Telegram entry in CISA’s exploited-bugs catalog (28 Oct)
- Three chained bugs give full control of the phone
- Versions 8.6.2 to 12.10.3 are affected
- Its GPT-5.4-based product found the bug
- No real attacks seen; Telegram did not see code execution, paid no bounty
- What bugs 2 and 3 are
- Whether the chain works on fully patched Android
- Whether the old iOS and desktop code was exploitable
- Telegram’s own statement
- Mar 2022Version 8.6.2First version NebuSec names as affected
- 21 Apr 2026Shared call library fixedtgcalls change “Fix camera rotation”. iOS picks it up in May, desktop in July (per The Hacker News)
- 24 Sep 2026Android 12.10.4 source published156 days after the library fix (my arithmetic)
- 26 Sep 2026NebuSec reports to TelegramTelegram acknowledges, does not consider it code execution (per NebuSec)
- 29 Oct 2026Public disclosurePost on X with a 22-second demo video
Sources: NebuSec on X, 29 Oct 2026; The Hacker News, 29 Oct 2026; Telegram Android source 12.10.3 vs 12.10.4; tgcalls, 21 Apr 2026; NVD search, 29 Oct 2026; CISA KEV 2026.10.28. Status labels and arithmetic: Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Answering a Call Matters
The reported trigger is an action users routinely take: answering an incoming call. That makes the issue relevant even though it is not described as a zero-click attack; the recipient must pick up. Google’s Project Zero wrote in 2018 that picking up a call is “a reasonable action to expect a user to take,” a point that helps explain why call-handling code can be an attractive target for security researchers.
For users, the immediate practical step is to update Telegram for Android to version 12.10.4 or later and check the installed version in the app’s settings. The source also recommends limiting who can call the account to contacts or nobody, and declining calls from unfamiliar accounts until the app is updated. For organizations, the episode highlights a gap in relying only on CVE feeds: if a flaw has no CVE, tools that track vulnerabilities by that identifier may not flag it. Administrators can set minimum app-version requirements for managed phones and define policies for messaging apps.
The claims should not be read as evidence that Telegram users were widely compromised. NebuSec said it had seen no real-world attacks. That is the company’s observation, not proof that no one ever exploited the issue.
Popular right now
Dyson Ball Animal 3 Corded Upright Vacuum
De'Longhi Magnifica Evo Fully Automatic Espresso Machine with Manual Milk Frother, Silver
Ninja CREAMi Scoop & Swirl 13-in-1 Ice Cream and Soft Serve Maker, NC701
As an affiliate, we earn on qualifying purchases.
The Patch Predates Disclosure
NebuSec announced the issue on X on October 29 and posted a short demonstration video. The source material describes a 22-second clip showing an attacker phone and a victim phone, with the victim’s display changing after the call connects. The video does not identify the Telegram or Android versions involved, and it does not provide a technical account of the full chain.
Telegram’s Android source code is publicly available. The source review found that the correction appeared in Android version 12.10.4, published September 24, while version 12.10.3 was published September 17. It also found that Telegram’s shared call library had received the same correction on April 21, 2026, in a change titled “Fix camera rotation.” The source says the Android change followed 156 days later; The Hacker News reported that iOS and desktop apps incorporated the shared change in May and July, respectively. Whether the older code was exploitable on those platforms has not been shown.
As of October 29, the source found no CVE listing for the flaw in the U.S. National Vulnerability Database and no Telegram entry in the U.S. Cybersecurity and Infrastructure Security Agency’s known exploited vulnerabilities catalog, using the catalog version dated October 28. Those absences describe the public records checked; they do not establish that the flaw was never used.
“Now picking up a wrong call can get you hacked.”
— NebuSec’s October 29 post on X
What the Evidence Does Not Show
The central uncertainty is the gap between the confirmed code correction and NebuSec’s account of the full attack. The source review says the Android code change matches the described call-handling issue, but the other two bugs and the complete chain have not been independently inspected. NebuSec’s research page had no technical write-up as of October 29, and the demo did not identify the software versions on the victim phone.
It also remains unclear whether the chain works against a fully patched Android device, whether the related older code could be exploited in iOS or desktop apps, or whether anyone used the flaw before disclosure. NebuSec said it had seen no attacks, but that does not establish that none occurred. The source material reports no public Telegram statement about the vulnerability or its assessment of the report.
Update and Watch for Details
Android users should check Telegram’s version in Settings and install 12.10.4 or later if an older release is present. Until updated, users can restrict incoming calls through Telegram’s call privacy setting and avoid answering calls from unfamiliar accounts. Workplaces can check that managed devices meet a minimum app version, including where their vulnerability process depends on CVE records.
Further clarity depends on additional technical evidence from NebuSec or Telegram, including details of the two other alleged vulnerabilities and the conditions needed to reproduce the chain. A public response from Telegram, a fuller disclosure, or confirmation of affected versions across other platforms could change what is known. For now, the Android call-code fix is documented in the version change, while the claimed end-to-end takeover remains attributed to NebuSec.
Key Questions
What is the Telegram Android flaw?
NebuSec reported a memory-related bug in Telegram’s Android call code. Its public-code review, described in the source material, found a change to how the app reads a video-rotation value in call status messages.
Could answering a call take over a phone?
NebuSec says the call flaw could be combined with two other bugs to gain control of an Android phone after a user answered. The full chain has not been independently verified in a public technical report, and the call bug alone was not said to be sufficient.
Which Telegram version fixes the reported Android bug?
The source material identifies Telegram for Android 12.10.4 as containing the fix. Users should check their installed version in the app’s settings and update if they are on an earlier release.
Is there evidence the flaw was used in real attacks?
NebuSec said it had seen no real-world attacks. That is not proof that the flaw was never exploited; the source material reports no public CVE or listing in the checked U.S. exploited-vulnerability catalog as of October 29, 2026.
Does the report affect Telegram on iPhone or desktop?
The source material says the reported exploit was tested on Android and does not establish that iOS or desktop versions were vulnerable. Shared call code received a similar correction, but exploitation on those platforms has not been shown.
Source: ThorstenMeyerAI.com
