🔍 Read the full analysis: Telegram’s Android Flaw: How To Understand The Reported Risk on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
NebuSec disclosed an Android Telegram call-handling flaw on October 29, saying it could be chained with two other bugs to take control of a phone after a user answered a call. Telegram’s Android version 12.10.4 contains the reported fix, but the full exploit chain has not been independently documented, and NebuSec says it has seen no real-world attacks.
Security startup NebuSec disclosed a flaw in Telegram’s Android voice-call code on October 29, saying it could be combined with two other bugs to give an attacker control of a phone after the user answered a call. The reported issue affects Telegram for Android versions 8.6.2 through 12.10.3; NebuSec says the app’s 12.10.4 update fixes it. The full attack chain has not been published for independent review, and NebuSec says it has not seen real-world attacks.
NebuSec said the call-handling flaw was one part of a three-bug chain. According to the company’s chief executive, Eten Zou, the call bug combined with a second flaw that leaked information to let an attacker escape Telegram’s app environment into Android. A third bug, which Zou described as an Android root exploit, could then provide administrator-level access. The company said an attacker needed an ordinary Telegram account and that the chain worked in private voice calls on ARM64 phones.
The reported attack required a person to answer an incoming call, making it a one-click scenario rather than an attack that works without user interaction. NebuSec posted a short demonstration showing a call connecting and the victim phone returning to its home screen, followed by a “HACKED BY NEBUSEC” graphic. The clip does not identify the Telegram or Android versions used, and it does not publicly establish the details of the other two bugs.
NebuSec said it reported the flaw to Telegram on September 26, after version 12.10.4 had appeared. Zou told The Hacker News that Telegram acknowledged the report but did not accept that the bug could enable remote code execution. According to Zou, no CVE number was assigned and no bounty was paid. Telegram had not issued a public comment in the source report. NebuSec also said it had seen no real attacks; that is not proof that the flaw was never used.
Infographic 01 · Telegram for Android
One tap on “answer”, three bugs, one fix.
What is confirmed, what rests on NebuSec’s word, and what nobody knows yet about the voice-call flaw fixed in Telegram for Android 12.10.4.
- The callAn ordinary Telegram account calls the victim
- The tapThe victim answers. Without this, no attack
- Bug 1Call code misreads a status message (MediaState)
- Bug 2An information leak helps break out of the app
- Bug 3An Android root exploit: messages, mic, camera
Chain as described by NebuSec’s CEO to The Hacker News. Bugs 2 and 3 are not public; no technical write-up exists yet.
- The bug and the fix match in Telegram’s public source (12.10.3 vs 12.10.4)
- Same correction in the shared call library on 21 Apr 2026, titled “Fix camera rotation”
- No CVE in the US vulnerability database (29 Oct)
- No Telegram entry in CISA’s exploited-bugs catalog (28 Oct)
- Three chained bugs give full control of the phone
- Versions 8.6.2 to 12.10.3 are affected
- Its GPT-5.4-based product found the bug
- No real attacks seen; Telegram did not see code execution, paid no bounty
- What bugs 2 and 3 are
- Whether the chain works on fully patched Android
- Whether the old iOS and desktop code was exploitable
- Telegram’s own statement
- Mar 2022Version 8.6.2First version NebuSec names as affected
- 21 Apr 2026Shared call library fixedtgcalls change “Fix camera rotation”. iOS picks it up in May, desktop in July (per The Hacker News)
- 24 Sep 2026Android 12.10.4 source published156 days after the library fix (my arithmetic)
- 26 Sep 2026NebuSec reports to TelegramTelegram acknowledges, does not consider it code execution (per NebuSec)
- 29 Oct 2026Public disclosurePost on X with a 22-second demo video
Sources: NebuSec on X, 29 Oct 2026; The Hacker News, 29 Oct 2026; Telegram Android source 12.10.3 vs 12.10.4; tgcalls, 21 Apr 2026; NVD search, 29 Oct 2026; CISA KEV 2026.10.28. Status labels and arithmetic: Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Answering a Call Matters
The report matters because answering an ordinary call is a routine action, while the alleged outcome—a chain ending in control of a phone—would expose far more than a single conversation. If the company’s account is accurate, access could extend to messages, the microphone and the camera. Those outcomes are claims about the complete chain, not independently confirmed details in a public technical report.
For users, the immediate step is straightforward: update Telegram for Android and check that the installed version is 12.10.4 or later. Until updated, NebuSec’s advice is to limit who can call through Telegram’s privacy settings to contacts or nobody, and to decline calls from unfamiliar accounts. These precautions reduce exposure to the reported route but do not establish whether any particular device was targeted.
The absence of a CVE also has practical consequences for organizations. Security tools and policies that rely only on CVE identifiers may not flag an issue reported without one. Employers using Telegram on managed phones may need to set a minimum app version and define which messaging apps are permitted, rather than relying solely on vulnerability-list monitoring.
Popular right now
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Dyson Ball Animal 3 Corded Upright Vacuum
Ninja Flip Toaster Oven & Air Fryer, 8-in-1, Stainless Steel, SP151
As an affiliate, we earn on qualifying purchases.
The Fix Predates the Disclosure
Telegram’s Android source code is publicly available. The source report says its author compared versions 12.10.3 and 12.10.4 and found a change in how the app reads a call-status message. In the older code, the app checked that one field was present but then read a different field that the message did not have to include. The newer code reads the checked field instead. That code comparison supports the existence of a change, but does not by itself prove the exploit chain NebuSec described.
The report also says Telegram’s shared calling library, used across its apps, received a similar correction on April 21, 2026, in a change titled “Fix camera rotation.” The Android source containing the correction appeared later, in September. The Hacker News reported that iOS incorporated the change in May and desktop in July. Whether the earlier code was exploitable on those platforms has not been shown.
As of October 29, the source report said the U.S. National Vulnerability Database listed no CVE for the flaw and the latest cited version of the Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog had no Telegram entry. Those absences mean the issue was not listed there at that time; they do not establish that no exploitation occurred.
“Now picking up a wrong call can get you hacked.”
— NebuSec, in its October 29 post on X
What the Public Evidence Shows
The central uncertainty is the gap between the code change that can be inspected and NebuSec’s claim about the complete attack chain. As of the disclosure, the company had not published a technical write-up detailing the second information-leak bug, the root exploit, or the steps needed to combine them. The demonstration video does not show the software versions involved, and the source report says the author could not independently verify those two additional bugs.
It is also unclear whether the reported chain works against a fully updated Android phone, whether any attackers used it before disclosure, or whether older call code in Telegram’s iOS and desktop apps presented a similar risk. NebuSec said it had no evidence of real-world attacks and had tested private voice calls on ARM64 devices. The available material does not establish how broadly those tests covered devices or configurations.
No CVE assignment or public Telegram response was identified in the source report as of October 29. Those facts limit what outside researchers and organizations can verify, but they do not resolve whether the reported issue was exploitable in the way NebuSec describes.
Updates and Verification Ahead
Android users should install Telegram 12.10.4 or a later version and confirm the version shown in the app’s settings. Anyone unable to update immediately can restrict incoming Telegram calls to contacts or disable them, following NebuSec’s guidance. Organizations should check managed devices for outdated installations and consider minimum-version requirements that do not depend on a CVE being issued.
The next useful development would be a detailed technical account from NebuSec, Telegram, or independent researchers that explains the full chain and the devices and app versions tested. A public response from Telegram could clarify the company’s assessment, the scope of the fix, and whether the earlier shared-library changes were intended to address a security issue. Until then, the Android patch is the clearest confirmed action users can take, while the broader claims remain attributed to NebuSec.
Key Questions
Which Telegram Android versions did NebuSec identify as affected?
NebuSec said the affected range was versions 8.6.2 through 12.10.3. It identified version 12.10.4 as containing the fix.
Did the reported flaw work without the user doing anything?
No. In NebuSec’s account, the user had to answer an incoming call. The company characterized the report as a one-click attack, not a zero-click attack.
Has the attack been independently verified?
The source report found a relevant code change between Telegram Android versions, but NebuSec had not published a full technical write-up of the claimed chain. The additional bugs and the claimed takeover were not independently confirmed in the material provided.
What should Telegram users do now?
Update Telegram for Android to version 12.10.4 or later. Until updated, users can restrict who may call them through Telegram’s privacy settings and decline calls from unfamiliar accounts.
Does the report establish that Telegram for iOS or desktop is vulnerable?
No. The source says related call code was updated in the shared library and that iOS and desktop apps received changes, but it does not establish that those apps were exploitable. The platform scope remains unclear.
Source: ThorstenMeyerAI.com
