🔍 Read the full analysis: Answering A Telegram Call: What Android Users Should Consider on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Security startup NebuSec disclosed a flaw in older Telegram for Android versions and said it could be combined with two other bugs to take control of a phone after the user answered a call. Telegram’s Android fix is in version 12.10.4, released in September, but the full attack chain has not been independently documented publicly and NebuSec says it has seen no real-world attacks.
Security startup NebuSec disclosed a flaw in Telegram for Android that it says could help attackers take control of a phone after a user answered a call, prompting users of older versions to update. Telegram fixed the reported call-code bug in version 12.10.4, released in September, according to NebuSec; the company says it has seen no real attacks exploiting it.
NebuSec said the affected Android versions ran from 8.6.2 through 12.10.3, spanning March 2022 to September 2026. Its chief executive, Eten Zou, told The Hacker News that the call bug was only one part of a proposed attack chain: two additional flaws were needed, including a separate Android root exploit that could grant administrator-level access. NebuSec said the chain was tested in private voice calls on ARM64 phones, a processor design used by most modern Android phones.
The disclosure appeared on NebuSec’s X account on October 29, accompanied by a short demonstration video. The video shows a call connecting on a phone labelled as the victim’s before the device returns to its home screen. It does not identify the Telegram or Android version used, and NebuSec had not published a technical write-up of the flaw as of the disclosure date. The full chain therefore rests on the company’s statements and demo, rather than a public technical report.
NebuSec said it reported the issue to Telegram on September 26, after the fixed Android version had appeared. Zou said Telegram acknowledged the report but did not agree that the bug could be turned into remote code execution. According to him, no CVE identifier was assigned and no bounty was paid. Telegram had not issued a public statement found by the source article.
Infographic 01 · Telegram for Android
One tap on “answer”, three bugs, one fix.
What is confirmed, what rests on NebuSec’s word, and what nobody knows yet about the voice-call flaw fixed in Telegram for Android 12.10.4.
- The callAn ordinary Telegram account calls the victim
- The tapThe victim answers. Without this, no attack
- Bug 1Call code misreads a status message (MediaState)
- Bug 2An information leak helps break out of the app
- Bug 3An Android root exploit: messages, mic, camera
Chain as described by NebuSec’s CEO to The Hacker News. Bugs 2 and 3 are not public; no technical write-up exists yet.
- The bug and the fix match in Telegram’s public source (12.10.3 vs 12.10.4)
- Same correction in the shared call library on 21 Apr 2026, titled “Fix camera rotation”
- No CVE in the US vulnerability database (29 Oct)
- No Telegram entry in CISA’s exploited-bugs catalog (28 Oct)
- Three chained bugs give full control of the phone
- Versions 8.6.2 to 12.10.3 are affected
- Its GPT-5.4-based product found the bug
- No real attacks seen; Telegram did not see code execution, paid no bounty
- What bugs 2 and 3 are
- Whether the chain works on fully patched Android
- Whether the old iOS and desktop code was exploitable
- Telegram’s own statement
- Mar 2022Version 8.6.2First version NebuSec names as affected
- 21 Apr 2026Shared call library fixedtgcalls change “Fix camera rotation”. iOS picks it up in May, desktop in July (per The Hacker News)
- 24 Sep 2026Android 12.10.4 source published156 days after the library fix (my arithmetic)
- 26 Sep 2026NebuSec reports to TelegramTelegram acknowledges, does not consider it code execution (per NebuSec)
- 29 Oct 2026Public disclosurePost on X with a 22-second demo video
Sources: NebuSec on X, 29 Oct 2026; The Hacker News, 29 Oct 2026; Telegram Android source 12.10.3 vs 12.10.4; tgcalls, 21 Apr 2026; NVD search, 29 Oct 2026; CISA KEV 2026.10.28. Status labels and arithmetic: Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Answering Calls Carries Risk
The reported issue matters because a user’s ordinary action—answering a call—could serve as the trigger for a more complex attack, if NebuSec’s account of the chain is accurate. This is not described as a zero-click attack: the victim would need to answer, and the call bug alone was not said to provide full control. Still, callers can contact people they do not know, so limiting who can call may reduce exposure while an app remains outdated.
For organizations, the lack of a CVE can make a vulnerability harder to track in security systems that rely on CVE feeds. The source material says no CVE was listed for the issue and no entry appeared in the cited US catalog of known exploited vulnerabilities as of October 29. Companies may need to check app versions directly rather than assume that vulnerability-scanning tools will flag this specific report.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Logitech MX Mechanical Wireless Illuminated Keyboard Tactile (Graphite)
Dell XPS 13 9350 AI Professional Laptop 13.4 120Hz FHD+ Display
As an affiliate, we earn on qualifying purchases.
The Android Fix and Its Timeline
NebuSec attributes the issue to Telegram’s Android voice-call code. The source article says a comparison of Telegram’s public Android code for versions 12.10.3 and 12.10.4 found a change in how the app reads a call-status message: the older code checked that a camera-rotation value existed but then read a different field, while the newer code reads the rotation field. The article describes this as consistent with the reported bug, though that code comparison does not independently verify the other two flaws or the complete attack chain.
The same source says Telegram’s shared call library received a correction on April 21, 2026, in a change titled “Fix camera rotation,” while the Android source containing the fix appeared later. It cites The Hacker News as reporting that iOS received the change in May and desktop in July. NebuSec did not establish that those platforms, or group calls, were directly vulnerable. A code change appearing in shared software does not by itself confirm that the attack worked on every platform.
“Now picking up a wrong call can get you hacked.”
— NebuSec, in its October 29 post on X
What the Public Evidence Does Not Show
The public material cited does not establish whether the complete chain works against a fully patched, current Android phone, whether anyone exploited the flaw before disclosure, or how the two additional bugs work. NebuSec said it had seen no real attacks, but that does not prove none occurred. The demonstration also does not identify the software versions shown.
There was no CVE entry for the flaw as of October 29, and the source article found no public Telegram response. NebuSec said it had no evidence that iOS, desktop or group calls were directly affected, but the absence of such evidence is not confirmation that those versions are safe. The exact scope and independent verification of the claimed chain remain unresolved.
Update Telegram and Restrict Calls
Android users should check Telegram’s version in the app’s Settings and update to 12.10.4 or later, the version NebuSec identified as containing the fix. Until updated, the source recommends changing “Who can call me?” to My Contacts or Nobody and declining calls from unknown people. These steps reduce exposure; they do not establish whether a device was previously affected.
Organizations using Telegram on work phones can check installed app versions and set a minimum-version policy, particularly if their security monitoring depends on CVE listings. Further clarity would require a public technical account of the reported chain, a response from Telegram, and evidence about the scope across Android versions and other Telegram platforms.
Key Questions
Which Telegram Android versions did NebuSec identify as affected?
NebuSec identified versions 8.6.2 through 12.10.3 as affected and said the issue was fixed in version 12.10.4.
Could the flaw hack a phone without the user doing anything?
NebuSec described an attack that required the victim to answer a call. It is therefore described as one-click, not zero-click, and the call bug reportedly needed to be combined with two other flaws.
Has Telegram confirmed the report publicly?
The source article found no public statement from Telegram as of October 29, 2026. NebuSec chief executive Eten Zou said Telegram acknowledged the report but disputed that the bug could enable remote code execution.
Is there evidence the flaw was used in real attacks?
NebuSec said it had seen no real attacks. The source material says there was no public evidence confirming prior exploitation; that does not establish that exploitation never occurred.
What should Android users do now?
Update Telegram to 12.10.4 or later. If an update is not yet available, set call permissions to My Contacts or Nobody and avoid answering calls from unknown people until the app is updated.
Source: ThorstenMeyerAI.com
