What Android Users Can Do After Learning About Telegram’s Call Flaw

🔍 Read the full analysis: What Android Users Can Do After Learning About Telegram’s Call Flaw on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get smart everyday buys delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram for Android on October 29, saying an attacker could use it as part of a chain of bugs to take control of a phone after the owner answered a call. Telegram had already released a fix in version 12.10.4 in late September, according to NebuSec. The company says it has seen no attacks exploiting the issue; users who have not updated should install the latest Telegram version and limit who can call them.

NebuSec says the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, a range spanning March 2022 to September 2026. Its chief executive, Eten Zou, told The Hacker News that the call-code bug was not enough on its own. According to Zou, an attacker could combine it with a separate information-disclosure bug and an Android root exploit to gain control of a device, including access to messages, the microphone and the camera. NebuSec says the attack required the victim to answer a private voice call, making it a one-click attack rather than a zero-click one.

NebuSec says it tested the chain on ARM64 Android phones, a chip architecture used by most modern Android devices. Its 22-second demonstration video shows a call connecting on a device labelled as the victim’s, followed by the phone returning to its home screen and displaying a “HACKED BY NEBUSEC” graphic. The video does not identify the Telegram or Android versions used. The company has not published a technical write-up laying out the full chain, so the claims about the additional bugs and the takeover remain based on its account and demonstration.

Telegram’s public Android source code offers some evidence about the underlying call-code change. A comparison of versions 12.10.3 and 12.10.4 found that the earlier code checked whether a camera-rotation field was present, then read a different video-state field that might not be included in a message. The later version reads the rotation field instead. Users can check Telegram’s version at the bottom of the app’s Settings screen. If it is below 12.10.4, they should update through the official app store or Telegram’s official distribution channel.

Why Answering a Call Matters

The report draws attention to the risk in features that process information from another user as soon as a call arrives. NebuSec says its attack required the recipient to answer, an action many users may take when a caller’s identity is unclear or when a call appears to come from a contact. That does not mean every unfamiliar Telegram call is malicious, or that answering a call now automatically gives an attacker access. The reported risk depends on an outdated app and, according to NebuSec, additional bugs in the attack chain.

For individual users, the practical steps are straightforward: update Telegram, restrict who can call you, and decline calls from unknown users while checking that the fix is installed. Telegram’s call privacy setting can be changed to “My Contacts” or “Nobody,” according to the source material. For organizations that manage work phones, the absence of a CVE could also leave the issue out of tools that rely on CVE identifiers. NebuSec’s disclosure is a reminder to enforce minimum app versions rather than relying only on vulnerability feeds.

Products Worth Considering

Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo

AmazonView Latest Price

FLEXISPOT Standing Desk with Monitor Riser & Cable Management

AmazonView Latest Price

Brother TD-2020A 2‑Inch Direct Thermal Desktop Label Printer with USB

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates the Disclosure

NebuSec says it reported the flaw to Telegram on September 26, after version 12.10.4 had appeared. Zou told The Hacker News that Telegram acknowledged the report but did not agree that the bug could be turned into remote code execution. NebuSec says it received no bounty. The source material reports no public statement from Telegram responding to the disclosure.

The shared call library used by Telegram’s Android, iOS and desktop apps received a similar correction on April 21, 2026, in a change titled “Fix camera rotation,” according to the source’s review of Telegram’s public code. The corrected Android source appeared later. The Hacker News reported that iOS incorporated the change in May and desktop in July. This timing does not establish that those versions were exploitable: NebuSec has not shown that iOS, desktop or group calls were affected.

As of October 29, the flaw had no CVE number and did not appear in the US Cybersecurity and Infrastructure Security Agency’s catalog of known exploited vulnerabilities, according to the source material. Those absences do not prove that the flaw was never used; they mean there was no corresponding CVE or catalog entry at that time.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

How Much of the Chain Is Verified

The complete attack chain has not been independently documented in a public technical report in the material available for this story. NebuSec says it confirmed the attack in private voice calls on ARM64 phones, but the demonstration does not show the software versions involved. The source review could not verify the two additional bugs, whether the chain works against a fully patched Android phone, or whether anyone exploited the flaw before the disclosure.

NebuSec says it has seen no real-world attacks. That is the company’s report, not proof that no one used the flaw. Telegram’s assessment of the issue, the status of any internal investigation and whether it plans to provide a public account remain unclear. It is also not established that the issue affected Telegram’s iOS or desktop apps, despite a related correction appearing in shared call code used by multiple platforms.

Check Your App and Call Settings

Android users should update Telegram and confirm the installed version is 12.10.4 or later. Until updated, they can set “Who can call me?” to “My Contacts” or “Nobody,” and avoid answering calls from people they do not recognize. Users should obtain updates through official channels and check the version again after installation.

Organizations using Telegram on managed phones can set a minimum app-version requirement and review messenger policies, especially if their security monitoring depends on CVE listings. Further clarity would require a fuller technical account from NebuSec, a public response from Telegram, or independent analysis of the reported attack chain. As of October 29, none of those details had been provided in the source material.

Key Questions

What should Android users do now?

Update Telegram to version 12.10.4 or later and check the installed version at the bottom of Settings. If an update is not yet available to you, restrict calls to contacts or nobody and decline calls from unknown people.

Did answering a Telegram call definitely expose a phone?

No. NebuSec says answering a private call was one step in an attack chain that also required other bugs. It has not published a full technical report, and it says it has seen no real-world attacks.

Which Telegram versions did NebuSec identify?

NebuSec says the affected range was Telegram for Android versions 8.6.2 through 12.10.3. The company identifies version 12.10.4 as fixed.

Are Telegram on iPhone or desktop confirmed affected?

No. The source material says a related correction appeared in shared call code and was added to iOS and desktop releases, but NebuSec has not shown that those apps were exploitable. The reported attack was demonstrated on Android.

Has the flaw been assigned a CVE?

Not as of October 29, 2026, according to the source material. It also reported no entry in the US catalog of known exploited vulnerabilities at that time. Those facts do not establish whether the flaw was ever used in an attack.

Source: ThorstenMeyerAI.com