A Closer Look At The Telegram Android Call Attack

🔍 Read the full analysis: A Closer Look At The Telegram Android Call Attack on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a memory-handling flaw in Telegram for Android on October 29, saying it could be combined with two additional bugs to give an attacker control of a phone after a user answered a call. Telegram fixed the reported call-code bug in version 12.10.4, released in September, according to NebuSec and a review of Telegram’s published Android source code. The full exploit chain has not been independently verified, and NebuSec says it has seen no real-world attacks.

NebuSec says the vulnerability affected Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. The startup described the call bug as one part of a chain: a second flaw allegedly leaked information and helped an attacker escape Telegram’s app boundary, while a third Android exploit allegedly provided root access, or administrator-level control. The attacker would need an ordinary Telegram account, and the victim would have to answer the incoming call. That makes the reported scenario a one-click attack, not a zero-click attack.

NebuSec chief executive Eten Zou told The Hacker News that the company tested the chain in private voice calls on ARM64 phones, a processor architecture used by most current Android phones. A 22-second demo published by the company shows a call connecting before the victim phone displays a takeover message. The video does not identify the Telegram or Android versions used, and NebuSec had not published a detailed technical report as of October 29. The claims about the additional vulnerabilities and complete compromise therefore rely on the company’s account and demonstration.

A review of Telegram’s public Android code provides support for the existence of the call-code error. In version 12.10.3, the app checked that a camera-rotation value existed but then read a different field, the video state, which a message was not required to include. Version 12.10.4 reads the rotation field instead. The source-code comparison supports that a bug was corrected; it does not, by itself, establish that the full attack chain works as described. NebuSec says it reported the issue to Telegram on September 26. Zou said Telegram acknowledged the report but did not consider the bug capable of enabling remote code execution. No CVE number was assigned and no bounty was paid, according to Zou. Telegram had not publicly commented as of October 29.

Why Answering a Call Matters

The report draws attention to a part of messaging apps that must handle information from callers before a conversation is underway. Answering a call is an ordinary user action, and the call setup process involves data arriving from another account. If the reported chain is accurate, that combination could make a call feature a route into a device rather than simply a way to communicate. The potential consequences described by NebuSec—access to messages, the microphone and the camera—are serious, but remain claims about a chain not yet documented in a public technical write-up.

For users, the immediate practical step is to update Telegram for Android to version 12.10.4 or later. Until updated, NebuSec’s guidance is to limit who can call through the app’s privacy settings to contacts or nobody, and to decline calls from unfamiliar accounts. For organizations, the case also points to a visibility gap: security systems that rely only on CVE identifiers may not flag an app flaw that has no CVE. Companies can set minimum app versions for work phones and establish rules for messaging-app use without treating the reported exploit chain as independently confirmed.

Products Worth Considering

Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue

AmazonView Latest Price

DJI Osmo Pocket 3 Creator Combo Vlogging Camera with Mic 2, 1 CMOS, 4K/120fps, 3-Axis Stabilization, 128GB Card

AmazonView Latest Price

Jackery HomePower 3000 Portable Power Station with Two 200W Solar Panels

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates the Disclosure

Telegram’s Android version 12.10.4 was released on September 24, according to the source material, two days before NebuSec reported the issue to the company. The Android source-code change corrects the field-reading error described above. The code review also found that Telegram’s shared call library received a similar correction on April 21, 2026, under the title “Fix camera rotation.” That earlier change appeared in the Android source 156 days later. The timeline suggests the code was corrected before NebuSec’s report, but it does not establish that Telegram understood the earlier change as a security fix.

The source material says The Hacker News reported that the iOS app incorporated the shared-library change in May and the desktop app in July. NebuSec said it had no evidence that iOS, desktop or group calls were directly affected. Whether older code in those versions could be exploited has not been shown. As of October 29, the US National Vulnerability Database had no CVE entry for the flaw, and the US Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog, dated October 28, had no Telegram entry. No listing is not proof that a flaw was never exploited; it only describes what those public records contained at that time.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in a post announcing the disclosure

What the Public Evidence Shows

The precise scope and exploitability remain unsettled. Telegram had not issued a public statement as of October 29, and NebuSec had not released a detailed technical write-up. The available demo does not reveal the software versions used, and the source-code comparison confirms a corrected coding error but not the two additional bugs or the complete takeover chain.

NebuSec says it has seen no real-world attacks. That is a statement about the company’s observations, not proof that nobody exploited the issue. It is also not clear whether the reported chain works against a fully patched, current Android device, whether other Telegram platforms were exposed, or whether the older shared-library code could be used in those apps. No CVE or known-exploitation listing was present in the cited US records on the dates checked.

Update and Watch for Detail

Android users can check Telegram’s version at the bottom of the app’s Settings screen and update to 12.10.4 or later if needed. Those unable to update immediately can restrict incoming calls to contacts or disable them, as NebuSec recommends. Organizations should check that managed phones meet a minimum app-version requirement and review whether their security monitoring depends exclusively on CVE feeds.

The next important developments would be a detailed technical account from NebuSec, a public response from Telegram, or independent analysis of the remaining bugs and the claimed attack chain. Until then, the code fix is verifiable from Telegram’s published Android source, while the full-device compromise described by NebuSec remains an attributed claim.

Key Questions

What did NebuSec report?

NebuSec reported a memory-handling flaw in Telegram’s Android call code. The company says an attacker could combine it with two other bugs to take control of a phone after the user answered a call. The full chain has not been independently verified in a public technical report.

Which Telegram version contains the fix?

NebuSec identifies Telegram for Android 12.10.4 as the fixed version. Users should update to that version or a later release and check the version shown in the app’s Settings.

Did the attack affect iPhones or desktop users?

The source material provides no evidence that iOS or desktop apps were directly affected. The shared call library received a correction, but whether older code in those platforms could be exploited has not been established.

Has the flaw been used in real attacks?

NebuSec said it had seen no real-world attacks as of its October 29 disclosure. That does not establish that exploitation never occurred, and the cited public US vulnerability records contained no entry for the flaw at that time.

What should users do if they cannot update yet?

NebuSec recommends limiting who can call through Telegram’s privacy settings to contacts or nobody, and declining calls from unfamiliar accounts until the app is updated.

Source: ThorstenMeyerAI.com