One Answered Telegram Call Could Run Code on Your Android
NebuSec says answering a Telegram voice call could let an attacker run code on Android in versions 8.6.2 to 12.10.3. It's fixed in 12.10.4; Telegram disputes the risk and no CVE was assigned.
Answering a Telegram voice call from a stranger could have let them run code on an Android phone, security startup NebuSec says, and Telegram quietly fixed the bug in version 12.10.4 in late September. The Hacker News reports the flaw sat in Telegram for Android from version 8.6.2 to 12.10.3, roughly March 2022 to September 2026. Telegram disputes that it could be turned into a working attack, so there’s no CVE and no bug bounty.
For defenders
The bug: during a call, Telegram apps exchange small “media state” messages about the camera and video. The Android app’s call code checked that a rotation value was present but then read the video-state field even when the message didn’t include it, reading memory it shouldn’t. The Hacker News compared the 12.10.3 and 12.10.4 source code and found the fix: 12.10.4 reads the rotation from the right field. The same correction landed in Telegram’s shared tgcalls library on April 21 and shipped in Telegram for iOS 12.7 (May) and Desktop 7.0.1 (July); NebuSec has no evidence those apps were exploitable.
What an attacker needs: any Telegram account, and a victim who picks up a private voice call. NebuSec, which says its AI code-review product found the flaw, describes it as the first step out of the Telegram app; a full phone takeover also needs a separate memory-leak bug and an Android root exploit, neither of which it has detailed. Its demo video shows a test phone being taken over about 30 seconds after answering, but doesn’t show the Telegram or Android versions. That’s T1203 (Exploitation for Client Execution).
Status: no exploitation in the wild known, per NebuSec. No CVE or CVSS score. No technical write-up or exploit code has been published. Telegram acknowledged the report, received Sept. 26 (after 12.10.4 had already shipped), but told NebuSec it didn’t think the bug could lead to code execution.
Also in the story: an older, separate Telegram issue, CVE-2026-111105 (CVSS 7.0) in the rlottie animation library, was disclosed by the Zero Day Initiative on Oct. 15 as unpatched; Telegram says server-side checks block it, a researcher says those can be bypassed, and the Android app has since replaced rlottie.
What it means for you
If you use Telegram on an Android phone, make sure the app is up to date; anything from 12.10.4 on has the fix. You’ll find your version at the bottom of Telegram’s Settings screen. There’s no sign anyone used this against real people, but a bug triggered just by answering a call is the kind spyware makers look for, so it’s also worth limiting who can call you at all.
Do this now
- Update Telegram from the Google Play Store and check that Settings shows version 12.10.4 or later.
- In Settings, Privacy and Security, Calls, set who can call you to “My Contacts” or “Nobody”.
- Don’t answer Telegram calls from accounts you don’t know.