Telegram for Android flaw let attackers run code when a victim answered a voice call
Telegram for Android
NebuSec disclosed a flaw in Telegram for Android that let an attacker with an ordinary Telegram account run code on a victim's phone once the victim answered a voice call. The bug was in the code that parses MediaState call messages (mute, camera and video rotation state), which mishandled missing fields and read memory it should not. Versions 8.6.2 through 12.10.3 (March 2022 to September 2026) are affected; Telegram fixed it in 12.10.4, released in late September. NebuSec confirmed it in private calls on ARM64 phones and has no evidence it directly affects the iOS or desktop apps or group calls. There was no CVE identifier as of October 29.
Why this severity: Remote code execution after the victim answers a call from any Telegram account; no CVE or CVSS score yet
- Started
- Oct 29, 2026
Affected
- Telegram for Android 8.6.2 through 12.10.3
Fixed in
- Telegram for Android 12.10.4+ (version shown at the bottom of Settings)
Timeline2
Advisories1
News & write-ups1
Posts1
Remember when scam callers only ask for your password? Good times. Now picking up a wrong call can get you hacked. Telegram RCE discovered by NebuSec Code Security, powered by GPT-5.4. Yes, GPT-5.4. We turned a dinosaur model into a cyber powerhouse. Fixed in Telegram Android t.co/EOmPf14OIS
Notes & caveats
No technical write-up from NebuSec yet; the step from the memory bug to code execution rests on its video and statements. Exploitation in the wild not reported.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
