The Call As A Potential Attack: Telegram’s Android Flaw In Focus

🔍 Read the full analysis: The Call As A Potential Attack: Telegram’s Android Flaw In Focus on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get smart everyday buys delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android call code on October 29, saying an attacker could exploit it after a user answered an incoming call if it were combined with two other bugs. The reported issue was fixed in Telegram Android version 12.10.4, released in late September, and NebuSec says it has seen no real-world attacks.

NebuSec said the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, a range spanning March 2022 to September 2026. According to chief executive Eten Zou, the call-handling bug was one part of a three-bug chain: a second flaw leaked information and an Android root exploit could then give an attacker administrator-level control of the device. Zou told The Hacker News that the chain was tested in private voice calls on ARM64 phones, a chip architecture used by most modern Android phones.

The company’s October 29 post on X included a short demonstration video. It depicts an incoming call connecting before the victim phone returns to its home screen and displays a NebuSec message. The video does not identify the Telegram or Android versions running on the test device, and NebuSec had not published a technical report describing the full chain by October 29. The detailed account therefore rests on the company’s statements and demonstration.

A review of Telegram’s public Android source code found a change to call-related code between versions 12.10.3 and 12.10.4. The reported issue involved a video-call status message: the older code checked whether a camera-rotation value was present but then read a separate video-state field that might be missing. The newer code reads the rotation field. That code change supports the existence of a relevant software correction, but by itself does not verify NebuSec’s claims about the other bugs or the full attack chain.

The Risk in Answering Calls

If NebuSec’s account is accurate, the flaw matters because an incoming call can prompt a user to perform the action needed to start an attack: answering a call from an unfamiliar person. The company characterizes the chain as a one-click attack, not a zero-click one. It says the attacker needed a Telegram account and the target needed to answer; it has not shown that simply receiving a call was enough.

The reported fix also makes the incident relevant to people and organizations that manage devices. A phone could hold private messages and provide access to its microphone and camera if the full chain gave an attacker the control NebuSec describes. Organizations that rely only on vulnerability databases may not see an issue without a CVE, so app-version requirements and rules for messenger use can matter alongside operating-system updates.

For individual users, the immediate step is straightforward: check Telegram’s version and install 12.10.4 or later. Until updated, the source advises limiting who can call the account to contacts or nobody and declining calls from unknown people. These precautions address the reported route; the available information does not establish that every unanswered or answered call posed a threat.

Products Worth Considering

Dell 34-Inch S3425DW Curved WQHD USB-C Monitor

AmazonView Latest Price

Dell P2725H 27-Inch Full HD Monitor

AmazonView Latest Price

Logitech MX Brio Ultra HD 4K Webcam, Graphite

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

A Fix Before Public Disclosure

NebuSec said it reported the issue to Telegram on September 26, shortly after version 12.10.4 appeared. Zou told The Hacker News that Telegram acknowledged the report but did not believe the bug could be used for remote code execution. He said no CVE was assigned and no bug bounty was paid. Those statements have not been confirmed in a public Telegram response; no public statement from Telegram was identified in the source material.

The code history adds a complication. Telegram’s shared call library, tgcalls, received a correction titled “Fix camera rotation” on April 21, 2026, according to the source’s review of public code. The Android source containing the fix appeared later, in September. The Hacker News reported that iOS incorporated the change in May and desktop in July. The existence of a shared-code change does not establish that those versions were vulnerable or exploitable, and NebuSec reported no evidence that iOS, desktop or group calls were directly affected.

As of October 29, the flaw had no CVE listing in the U.S. National Vulnerability Database, and Telegram was not listed in the Cybersecurity and Infrastructure Security Agency’s catalog of known exploited vulnerabilities cited by the source. NebuSec also said it had seen no real attacks. These are limits on what was publicly documented, not proof that exploitation never occurred.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in a post on X

What the Public Evidence Cannot Show

The central uncertainty is whether NebuSec’s full account can be independently reproduced. The company had not released technical details of the two additional bugs or a full write-up by October 29, and the demonstration does not show the software versions involved. The public code change is consistent with a fix to call-related handling, but it does not confirm that the described chain worked as claimed.

It is also unclear whether any attacker used the flaw before the fix, whether it worked on fully updated Android devices, or whether earlier versions of Telegram on iOS or desktop were exploitable. NebuSec said it had seen no attacks; that statement describes the company’s visibility, not a definitive finding that none occurred. Telegram’s response to the report and the reason no CVE was assigned have not been independently confirmed in a public statement.

Check the App Version

Telegram users can check the version shown in the app’s settings and update to 12.10.4 or later. Until they do, they can restrict incoming calls to contacts or turn them off, and avoid answering calls from unfamiliar accounts. These steps follow the risk described by NebuSec; they do not establish that a particular call is malicious.

Further clarity depends on whether NebuSec publishes technical evidence and whether Telegram comments publicly on the report, the fix and the affected versions. Security teams can check device inventories, set minimum app-version rules and decide what messenger use is permitted on work phones. Without a CVE or detailed disclosure, those local controls may be the main way to track whether company devices have received the app update.

Key Questions

Which Telegram versions does NebuSec say were affected?

NebuSec said the issue affected Telegram for Android versions 8.6.2 through 12.10.3. It identified version 12.10.4 as containing the fix. The company did not establish that iOS or desktop apps were directly affected.

Did an attacker need the user to answer the call?

According to NebuSec, yes. The company described the attack as one-click because the user had to answer. It did not claim that simply receiving a call was enough.

Has Telegram confirmed the vulnerability publicly?

The source material reports no public Telegram statement as of October 29. NebuSec’s chief executive said Telegram acknowledged the report, but that account has not been confirmed by a public response from Telegram.

Is there evidence the flaw was used in real attacks?

NebuSec said it had seen no real attacks. The source also reports no CVE or listing in the cited U.S. catalog of known exploited vulnerabilities. Those facts do not prove that exploitation never happened.

What should Telegram users do now?

Update Telegram for Android to version 12.10.4 or later. If an update is not yet available, consider limiting calls to contacts or nobody and declining calls from unfamiliar accounts.

Source: ThorstenMeyerAI.com