What Android Users Should Know About Telegram’s Call Vulnerability

🔍 Read the full analysis: What Android Users Should Know About Telegram’s Call Vulnerability on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get hardware and tech essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a Telegram for Android call vulnerability on October 29, saying an attacker could use it as part of a three-bug chain to gain control of a phone after its owner answered a call. The company says the flaw was fixed in Telegram Android version 12.10.4, released in late September, and that it has seen no real-world attacks. The extent of the reported risk remains difficult to verify because NebuSec has not published a technical write-up and Telegram had not issued a public statement as of October 29.

NebuSec says the vulnerability affected Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. According to the company’s chief executive, Eten Zou, the call-code bug alone was not enough to take over a device. It allegedly had to be combined with a second bug that exposed information and a third exploit that provided Android root privileges, or full administrator access. The attack would require the target to answer an incoming call, making it a one-click attack rather than a zero-click attack.

NebuSec says it reproduced the chain in private Telegram voice calls on ARM64 devices, a chip architecture used by most modern Android phones. Its 22-second demonstration shows a call connecting on a victim phone, followed by the phone returning to its home screen and a “HACKED BY NEBUSEC” graphic. The video does not identify the Telegram or Android versions used, and it does not show the technical details of the other two bugs. Those claims therefore remain attributed to NebuSec, not independently established by the demonstration.

A review of Telegram’s public Android source code described in the source report found a change to call-related code between versions 12.10.3 and 12.10.4. The earlier code checked whether one call-message field was present but then read a different field that might be missing; the later code reads the field it checked. NebuSec reported the issue to Telegram on September 26, after the fixed version appeared, Zou told The Hacker News. He said Telegram acknowledged the report but did not agree that the bug enabled remote code execution. The source report found no public Telegram response, CVE identifier or entry for the issue in the U.S. catalog of known exploited vulnerabilities as of October 29.

Why Answering a Call Matters

The reported bug matters because a normal call answer could serve as the trigger for a much broader compromise, if NebuSec’s described chain works as claimed. A successful takeover could expose messages, microphone and camera access, Zou said. Those are serious potential consequences, but the account depends on NebuSec’s description of the additional vulnerabilities and their combination; the public demo and code change do not by themselves establish the full chain.

For users, the immediate protective step is straightforward: update Telegram and check that its Android version is 12.10.4 or later. Until updated, users can set “Who can call me?” to “My Contacts” or “Nobody” and avoid answering calls from unknown accounts. These steps reduce exposure to the described scenario but do not confirm whether a particular device was targeted or whether the chain works on every Android phone.

The disclosure also highlights a practical issue for organizations managing work phones. If a flaw has no CVE identifier, security systems that rely on CVE feeds may not flag it. NebuSec’s account could not be verified through such a listing as of the disclosure date, so organizations may need to check app versions directly and apply their own minimum-version policies rather than rely only on vulnerability databases.

Products Worth Considering

Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo

AmazonView Latest Price

Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit

AmazonView Latest Price

LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix and Its Timeline

The source report says Telegram’s Android version 12.10.3 was published September 17, and version 12.10.4 with the call-code correction appeared on September 24. NebuSec disclosed the flaw publicly on October 29. Zou said the company had sent its report to Telegram on September 26, after the corrected Android version was available.

The report also traced a similar correction in Telegram’s shared call library, tgcalls, to an April 21, 2026, code change titled “Fix camera rotation.” It says the iOS app received that change in May and the desktop app in July, citing The Hacker News. That timing does not establish that those versions were vulnerable or exploitable. NebuSec said it had no evidence that iOS, desktop or group calls were directly affected.

Call features must process setup and status information from other users, including people who are not in a contact list. Google’s Project Zero wrote in 2018 that picking up a call is “a reasonable action to expect a user to take.” That observation helps explain why call-handling code can be a security target; it is not evidence about the impact or exploitability of this specific Telegram flaw.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

What the Public Evidence Shows

The central unresolved issue is whether the full three-bug chain works as NebuSec described. The startup has not published a technical write-up, and the short video does not identify the software versions or reveal how the second and third bugs operate. The source report says its code review found a change consistent with the call-code flaw, but it could not verify the other two bugs, the complete takeover chain, or whether it works on a fully patched Android device.

NebuSec said it had seen no real attacks. That does not establish that the flaw was never exploited. The report also found no CVE identifier, no listing in the U.S. National Vulnerability Database and no entry in CISA’s known exploited vulnerabilities catalog as of October 29. Those absences describe the public records checked at that time; they do not prove that no attack occurred.

Telegram’s public position was also unclear as of the disclosure date. Zou said the company acknowledged the report but disputed that the issue could be used for remote code execution, while the source report found no public Telegram comment. The precise affected-device range and the security status of iOS, desktop and group calls have not been established publicly.

Update Telegram and Watch for Details

Android users should install the latest Telegram release available to them and confirm in the app’s Settings that the version is 12.10.4 or later. If an update is not yet available through their usual channel, users can limit incoming calls to contacts or disable them until they can update. Users should also keep Android itself current, although the source material does not say that an operating-system update alone fixes this Telegram issue.

The next key developments would be a public technical account from NebuSec, a response from Telegram, or independent research that tests the claimed exploit chain and clarifies which devices and app versions are affected. Companies using Telegram on managed phones can check installed app versions and set a minimum-version policy. Until more evidence is published, the disclosed call-code flaw and fix are documented in the source report, while the claimed full device takeover remains a researcher’s account that has not been independently confirmed.

Key Questions

Which Telegram Android versions did NebuSec identify?

NebuSec said the affected range was versions 8.6.2 through 12.10.3. It identified version 12.10.4 as fixed. The full exploit chain has not been publicly documented.

What should Android users do?

Update Telegram and check that Settings shows version 12.10.4 or later. Until updated, users can restrict calls to contacts or set “Who can call me?” to “Nobody,” and decline calls from unknown accounts.

Did answering a call alone give an attacker full control?

Not according to NebuSec’s account: the company said the call flaw had to be combined with two additional bugs, including an Android root exploit. The full chain has not been independently confirmed in a public technical report.

Were Telegram users actually attacked?

NebuSec said it had seen no real-world attacks. That is the company’s report, not proof that the flaw was never used. The source material identified no public evidence establishing prior attacks.

Does the report say iPhone or desktop users are affected?

No direct impact on iOS or desktop was established. NebuSec said it had no evidence those apps or group calls were directly affected; the source report noted that related shared call code was updated in those apps, but that alone does not establish exploitability.

Source: ThorstenMeyerAI.com