Could The Telegram Android Flaw Change How You Handle Calls?

🔍 Read the full analysis: Could The Telegram Android Flaw Change How You Handle Calls? on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android call code on October 29, saying an attacker could take control of a phone if a user answered a call and the flaw was combined with two other bugs. Telegram’s version 12.10.4, released in September, contains the relevant code fix, according to NebuSec and a comparison of Telegram’s public source code. The company says it has seen no real-world attacks, but the full exploit chain has not been published for independent review.

NebuSec said the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, covering releases from March 2022 to September 2026. The startup described the call-code bug as one part of a chain: a second bug allegedly disclosed information and helped an attacker escape the Telegram app, while a third Android exploit allegedly provided root access, or administrator-level control. The call needed to be answered, making the scenario a one-click attack, not a zero-click attack.

NebuSec chief executive Eten Zou told The Hacker News that the company tested the chain in private voice calls on ARM64 Android phones. A short demonstration video shows a call connecting before the victim phone returns to its home screen and displays a NebuSec logo. The video does not identify the Telegram or Android versions used, and NebuSec had not published a technical write-up as of October 29. The claims about the additional bugs and full device takeover therefore rest on the company’s account and demo.

A review of Telegram’s public Android source code found a change between versions 12.10.3 and 12.10.4 in the handling of a call-status message. The earlier code checked that a camera-rotation value existed but then read a different field; the later code reads the rotation field. NebuSec reported the issue to Telegram on September 26, Zou told The Hacker News. He said Telegram acknowledged the report but did not consider the bug capable of remote code execution. No CVE was assigned, and Zou said no bounty was paid. No public Telegram comment was identified in the source material.

Why Answered Calls Can Carry Risk

Call features must process incoming connection and status data before a user has much information about who is calling. That makes flaws in call-handling code relevant even when a user must answer the call: a familiar action can become the entry point for a larger exploit chain. Google’s Project Zero wrote in 2018 that picking up a call is “a reasonable action to expect a user to take.”

For individual users, the immediate practical step is to update Telegram for Android and restrict who can call them while updating is not possible. For organizations, the lack of a CVE creates a tracking gap: security tools that rely only on CVE records may not flag the issue. Employers can set minimum app versions on work phones and define which messaging apps are permitted.

The risk should not be overstated. NebuSec says it has no evidence of real-world attacks, and the public material does not establish that answering an ordinary call on a fully updated phone leads to compromise. The reported severity depends on chaining the call bug with separate vulnerabilities.

Products Worth Considering

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue

AmazonView Latest Price

LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates the Disclosure

Telegram’s Android version 12.10.4 appeared in September, before NebuSec’s public disclosure on October 29. The source-code comparison described in the source material found the Android correction in version 12.10.4; it also found that Telegram’s shared call library, tgcalls, received a similar correction on April 21, 2026, in a change titled “Fix camera rotation.” The source material says the Android change appeared 156 days later. The Hacker News reported that iOS incorporated the change in May and desktop in July, but whether those older versions were exploitable has not been demonstrated.

As of October 29, the U.S. National Vulnerability Database had no CVE entry for the flaw, and the Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog dated October 28 had no Telegram entry. Those absences do not establish that the bug was harmless or never exploited; they describe the status of public vulnerability and exploitation records at that time.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in a post on X announcing the issue

Limits of the Public Evidence

The central unresolved issue is whether the full exploit chain works as described outside NebuSec’s tests. The public demo does not show the victim’s software versions, and the company had not released a technical account of the call flaw or the two additional bugs as of October 29. The source material also says those additional bugs, the chain’s operation on a fully patched Android device, and any prior exploitation could not be independently checked.

NebuSec reported no observed attacks, but no attacks seen is not proof that none occurred. It is also not established that iOS, desktop, or group calls were directly affected. The shared-library changes across platforms provide relevant context, but do not by themselves prove that those versions were vulnerable to the same attack.

Update and Restrict Incoming Calls

Android users should install Telegram 12.10.4 or later and check the version listed at the bottom of the app’s Settings screen. Until updated, users can set “Who can call me?” to “My Contacts” or “Nobody” and decline calls from unknown people. These steps reduce exposure to the reported call scenario; they do not establish whether a particular device was previously targeted.

Organizations should check their device-management policies for minimum Telegram versions rather than relying only on CVE feeds. Further clarity would depend on a public technical write-up from NebuSec, a response from Telegram, or independent analysis of the complete exploit chain. The status of those disclosures and any confirmed exploitation remains unknown in the source material.

Key Questions

What is the Telegram Android flaw?

NebuSec says a bug in Telegram’s Android call code could be combined with two other bugs to take control of a phone after a user answered a call. The complete chain has not been publicly documented for independent review.

Which Telegram version fixes the reported issue?

NebuSec identifies Telegram for Android 12.10.4 as the fixed version. Users should update to that version or a later release and check the version shown in Settings.

Does the attack work without answering a call?

Not according to NebuSec’s description. The reported scenario requires the user to answer, so the company characterized it as a one-click attack, rather than a zero-click attack.

Have attackers used the flaw in real incidents?

NebuSec said it had seen no real-world attacks. That is the company’s reported observation, not proof that the flaw was never exploited.

Are Telegram on iPhone and desktop affected?

The source material says NebuSec had no evidence that iOS, desktop, or group calls were directly affected. Similar code changes were reported across platforms, but exposure to the same exploit has not been established.

Source: ThorstenMeyerAI.com