{
  "slug": "telegram-android-voice-call-mediastate-rce-oct-2026",
  "category": "patch",
  "title": "Telegram for Android flaw let attackers run code when a victim answered a voice call",
  "summary": "NebuSec disclosed a flaw in Telegram for Android that let an attacker with an ordinary Telegram account run code on a victim's phone once the victim answered a voice call. The bug was in the code that parses MediaState call messages (mute, camera and video rotation state), which mishandled missing fields and read memory it should not. Versions 8.6.2 through 12.10.3 (March 2022 to September 2026) are affected; Telegram fixed it in 12.10.4, released in late September. NebuSec confirmed it in private calls on ARM64 phones and has no evidence it directly affects the iOS or desktop apps or group calls. There was no CVE identifier as of October 29.",
  "cveIds": [],
  "product": "Telegram for Android",
  "stacks": [],
  "tags": [
    "telegram",
    "android",
    "rce"
  ],
  "severity": "high",
  "severityNote": "Remote code execution after the victim answers a call from any Telegram account; no CVE or CVSS score yet",
  "status": "live",
  "startedAt": "2026-10-29",
  "patchStatus": "patched",
  "affectedVersions": [
    "Telegram for Android 8.6.2 through 12.10.3"
  ],
  "fixedVersions": [
    "Telegram for Android 12.10.4+ (version shown at the bottom of Settings)"
  ],
  "timeline": [
    {
      "date": "2026-09",
      "title": "Telegram for Android 12.10.4 ships the fix, reading the rotation value from the right field in MediaState call messages.",
      "sourceUrl": "https://thehackernews.com/2026/10/telegram-android-flaw-lets-attackers.html"
    },
    {
      "date": "2026-10-29",
      "title": "NebuSec discloses the voice-call code execution flaw with a demo video; The Hacker News confirms the matching bug in Telegram's published 12.10.3 source.",
      "sourceUrl": "https://x.com/nebusecurity/status/2115601122727702634"
    }
  ],
  "grouping": "none",
  "sources": [
    {
      "kind": "advisory",
      "title": "NebuSec disclosure of the Telegram Android call RCE",
      "url": "https://x.com/nebusecurity/status/2115601122727702634",
      "publisher": "NebuSec",
      "date": "2026-10-29"
    },
    {
      "kind": "news",
      "title": "Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls",
      "url": "https://thehackernews.com/2026/10/telegram-android-flaw-lets-attackers.html",
      "publisher": "The Hacker News",
      "date": "2026-10-29"
    }
  ],
  "tweets": [
    {
      "authorName": "NebuSec",
      "handle": "nebusecurity",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2086613834614427648/0gf0KZnE_bigger.jpg",
      "text": "Remember when scam callers only ask for your password? Good times.\n\nNow picking up a wrong call can get you hacked.\nTelegram RCE discovered by NebuSec Code Security, powered by GPT-5.4.\n\nYes, GPT-5.4. We turned a dinosaur model into a cyber powerhouse.\n\nFixed in Telegram Android https://t.co/EOmPf14OIS",
      "date": "2026-10-29T00:26:28.000Z",
      "url": "https://x.com/nebusecurity/status/2115601122727702634",
      "media": []
    }
  ],
  "notes": "No technical write-up from NebuSec yet; the step from the memory bug to code execution rests on its video and statements. Exploitation in the wild not reported.",
  "updatedAt": "2026-10-29T12:47:05Z",
  "xPost": {
    "id": "2115788742879518961",
    "postedAt": "2026-10-29T12:52:00.762Z",
    "url": "https://x.com/pwnwatch_app/status/2115788742879518961"
  },
  "url": "https://pwn.watch/i/telegram-android-voice-call-mediastate-rce-oct-2026",
  "json": "https://pwn.watch/i/telegram-android-voice-call-mediastate-rce-oct-2026.json",
  "sections": [],
  "agentBrief": "# Security brief: Telegram for Android flaw let attackers run code when a victim answered a voice call\n\nSource: https://pwn.watch/i/telegram-android-voice-call-mediastate-rce-oct-2026 · status: live · severity: high · updated Oct 29, 2026, 12:47 UTC\n\n## Patch status\n**PATCHED: fixed releases exist. Upgrade to a fixed version.**\n\n## What it is\nNebuSec disclosed a flaw in Telegram for Android that let an attacker with an ordinary Telegram account run code on a victim's phone once the victim answered a voice call. The bug was in the code that parses MediaState call messages (mute, camera and video rotation state), which mishandled missing fields and read memory it should not. Versions 8.6.2 through 12.10.3 (March 2022 to September 2026) are affected; Telegram fixed it in 12.10.4, released in late September. NebuSec confirmed it in private calls on ARM64 phones and has no evidence it directly affects the iOS or desktop apps or group calls. There was no CVE identifier as of October 29.\n\nSeverity detail: Remote code execution after the victim answers a call from any Telegram account; no CVE or CVSS score yet\n\n- Product: Telegram for Android\n\n## Affected versions\n- Telegram for Android 8.6.2 through 12.10.3\n\n## Check whether you're affected\nNo generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.\n\n## Fix\nUpgrade to one of these fixed versions (or later on the same branch):\n- Telegram for Android 12.10.4+ (version shown at the bottom of Settings)\n\nAfter upgrading, re-run the checks above and redeploy/restart the affected services.\n\n## Latest updates\n- Oct 29, 2026: NebuSec discloses the voice-call code execution flaw with a demo video; The Hacker News confirms the matching bug in Telegram's published 12.10.3 source.\n- Sep 2026: Telegram for Android 12.10.4 ships the fix, reading the rotation value from the right field in MediaState call messages.\n\n## Advisories\n- [NebuSec disclosure of the Telegram Android call RCE](https://x.com/nebusecurity/status/2115601122727702634) (NebuSec)\n\n## Write-ups & news\n- [Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls](https://thehackernews.com/2026/10/telegram-android-flaw-lets-attackers.html)\n\n## Caveats\nNo technical write-up from NebuSec yet; the step from the memory bug to code execution rests on its video and statements. Exploitation in the wild not reported.\n\n---\nMachine-readable: https://pwn.watch/i/telegram-android-voice-call-mediastate-rce-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems."
}