Telegram’s Android Flaw And The Risk Around Answering Calls

🔍 Read the full analysis: Telegram’s Android Flaw And The Risk Around Answering Calls on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android call-handling code on October 29, saying an attacker could take control of a phone after its owner answered a call if the flaw were combined with two other bugs. Telegram had already included a relevant fix in Android version 12.10.4, released in September, according to the company and a review of Telegram’s public source code described in the source report.

NebuSec says the vulnerability affected Telegram for Android versions 8.6.2 through 12.10.3, a range spanning March 2022 to September 2026. The company says the call-code bug was not sufficient by itself: paired with a second flaw that exposed information and a third Android root exploit, it could allow an attacker to leave the app and gain full control of the device. Root access refers to administrator-level control. NebuSec says the chain could expose messages and provide access to the microphone and camera.

The attack described is one-click, not zero-click: the target would have to answer an incoming call. NebuSec says it tested the chain using private voice calls on ARM64 phones, a processor design used in most modern Android devices. Its 22-second demonstration video depicts a victim phone connecting to a call and then returning to its home screen. The video does not identify the Telegram or Android version shown, and the source report says NebuSec had not published a technical write-up of the flaw as of October 29.

A review of Telegram’s public Android code found a change between versions 12.10.3 and 12.10.4 involving a call-status message field. In the older code, the app checked that a camera-rotation value existed but then read a different field; the newer code reads the rotation field. That supports the presence of a code correction, but does not independently establish the full three-bug exploit chain. The source report says it could not verify the other two bugs or whether the entire chain works on a current, fully patched Android phone.

Why Answering a Call Matters

The reported risk sits at an unusually familiar point in a phone interaction: answering an incoming call. If NebuSec’s account is accurate, a user would not need to open a file or install an app; accepting a call could provide the trigger for a chain that uses flaws in the messenger and Android. That makes the report relevant to people who use Telegram for personal or work communications, particularly on devices running older versions.

The account also illustrates a visibility problem for security teams. The source report says the flaw has no CVE identifier and does not appear in the U.S. government’s catalog of known exploited vulnerabilities as of October 29. Organizations that rely on CVE feeds alone may not see it in those systems. Administrators can reduce exposure by setting minimum app versions on managed phones and applying clear rules for messenger use, while individual users can update the app and limit who may call them.

Those precautions should not be read as evidence that the flaw is being exploited. NebuSec says it has seen no real attacks, and the source material provides no independent confirmation of exploitation. The practical message is to install the available update and treat the severity claims as attributed research findings until more technical evidence is published.

Products Worth Considering

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue

AmazonView Latest Price

DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

How the Android Fix Emerged

NebuSec chief executive Eten Zou told The Hacker News that the company reported the issue to Telegram on September 26, shortly after version 12.10.4 had appeared. Zou said Telegram acknowledged the report but did not believe the issue could be used for remote code execution; he also said no bug bounty was paid. The source report says it found no public response from Telegram as of October 29.

The fix may predate that report by several months. According to the source writer’s examination of Telegram’s public code, the shared tgcalls library received the same correction on April 21, 2026, in a change titled “Fix camera rotation.” The Android source containing the fix appeared later, on September 24, according to the report. The writer says this suggests the change may initially have been treated as a camera issue rather than a security vulnerability; that is an interpretation, not a stated conclusion from Telegram.

The source report says Telegram’s shared call library is used across Android, iOS and desktop, and cites The Hacker News as reporting that iOS and desktop received the change in May and July. NebuSec has not shown those apps are affected, and the source material says there is no evidence that group calls are directly affected. The reported scope is specifically Telegram for Android.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

What the Exploit Evidence Shows

The full severity claim remains based primarily on NebuSec’s account. The source material describes a short demonstration but says the video does not show the Telegram or Android versions on the victim phone. NebuSec had not released a technical write-up by October 29, and the source writer could not independently check the two additional bugs needed for the reported takeover chain.

It is also unclear whether the complete chain works against a fully updated Android device, whether anyone used the flaw before disclosure, or whether related code in other Telegram apps can be exploited. NebuSec says it has seen no real attacks; that is not proof that no attack occurred. The source report says there was no CVE listing or entry in the U.S. catalog of known exploited vulnerabilities at the time it checked, but those absences do not settle whether the vulnerability was exploitable.

Update Telegram and Watch for Detail

Android users should update Telegram to version 12.10.4 or later and check the version shown in the app’s settings. Until updated, the source report recommends setting “Who can call me?” to “My Contacts” or “Nobody,” and declining calls from unfamiliar people. These steps reduce exposure to the reported call-triggered route; they do not verify or resolve any separate Android vulnerabilities.

For organizations, the immediate response is to confirm installed app versions on managed devices and decide whether to set a minimum version or restrict messenger calls under workplace policy. Further clarity depends on whether NebuSec publishes technical details, whether Telegram issues a public statement, and whether independent researchers can validate the reported chain and its platform scope.

Key Questions

What is the Telegram Android flaw?

NebuSec describes a memory-handling flaw in Telegram’s Android call code. It says the bug could be combined with two other vulnerabilities to take control of a phone after the user answered a call. The complete chain has not been independently verified in the source material.

Which Telegram version contains the fix?

The source report identifies Telegram for Android 12.10.4 as the version containing the fix. Users should update to that version or a later release and confirm the installed version in Telegram’s settings.

Could someone be hacked without answering a call?

NebuSec’s description requires the target to answer an incoming call. The report therefore characterizes it as a one-click attack, not a zero-click attack. The source material does not establish that simply receiving a call is enough.

Has the flaw been used in real attacks?

NebuSec says it has seen no real attacks. The source material provides no independent evidence of exploitation, and the lack of reported attacks does not establish that none occurred.

Are Telegram on iPhone or desktop affected?

The reported scope is Telegram for Android. The source material says NebuSec has not shown that iOS, desktop or group calls are directly affected, although related call-library code is shared across platforms. The status of those apps has not been established by the available evidence.

Source: ThorstenMeyerAI.com