How To Respond To The Telegram Android Call Flaw

🔍 Read the full analysis: How To Respond To The Telegram Android Call Flaw on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram for Android on October 29, 2026, saying an attacker could exploit it after a user answered an incoming call. The company says the flaw was fixed in version 12.10.4, released in September; users should update and limit calls from strangers while key details remain unverified.

NebuSec says the bug affected Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. According to the company, the call-handling flaw alone was not enough to take over a device: it had to be combined with two other bugs, one that leaked information and another that could grant Android root access. NebuSec says the completed chain could give an attacker control of the phone, including access to messages, the microphone and the camera.

The company’s chief executive, Eten Zou, told The Hacker News that NebuSec tested the attack in private voice calls on ARM64 phones. The source report says NebuSec’s public demonstration shows a call connecting before the victim’s phone returns to its home screen, but does not identify the Telegram or Android version used. The demonstration and the company’s account do not independently establish that every part of the exploit chain works as described.

The source report’s author says a comparison of Telegram’s public Android code for versions 12.10.3 and 12.10.4 found a change consistent with the reported call-state bug. The earlier code checked that one field was present but read a different field; the later code reads the field it checked. NebuSec says it has seen no real attacks. The flaw has no CVE number, and the source material says it was not listed in the U.S. catalog of known exploited vulnerabilities as of October 28.

Protecting Calls on Android

The report concerns a feature that users may accept quickly: answering an incoming call. If NebuSec’s account is accurate, a call could serve as the entry point for a larger attack chain. The company describes this as a one-click attack because the target has to answer; it is not a zero-click exploit that acts without user interaction.

For individual users, the practical response is straightforward even while the technical claims are unresolved: update Telegram, check the installed version, and temporarily restrict who can call. For employers, the absence of a CVE may make the issue harder to find in tools that track vulnerabilities by identifier. Organizations should check app versions on managed phones and apply their own messenger policies rather than relying only on CVE feeds.

The distinction between a confirmed code change and a claimed full compromise matters. Updating addresses the affected Android app version identified in the report, but the public evidence described so far does not independently verify the complete chain or show that attackers used it.

Products Worth Considering

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

DJI Osmo Pocket 3 Creator Combo Vlogging Camera with 1 CMOS & 4K/120fps

AmazonView Latest Price

Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

A Fix Before Public Disclosure

NebuSec disclosed the issue on October 29, after Telegram Android version 12.10.4 had already appeared in September. The source material says Zou reported the flaw to Telegram on September 26 and that Telegram acknowledged the report. Zou said Telegram did not believe the bug could be turned into remote code execution, and that no bounty was paid. These details are attributed to Zou; the source says it found no public response from Telegram.

The source report also says Telegram’s shared calling library received a similar correction on April 21, 2026, in a change titled “Fix camera rotation.” It reports that iOS and desktop versions later incorporated the change, but does not establish whether those apps were exploitable. NebuSec said it had no evidence that iOS, desktop or group calls were directly affected.

Telegram’s call feature must process connection and status data from callers, including people who may not be known to the recipient. That makes call-handling code security-sensitive, but the general risk does not prove this particular flaw was exploited or that every incoming call posed a threat.

What the Public Evidence Shows

The full exploit chain remains unverified in public detail. The source material says NebuSec had not published a technical write-up by October 29, and its short demonstration does not show the app and operating-system versions on the victim phone. The two additional bugs, the conditions needed to use them and whether the chain works against a fully patched Android system could not be checked by the source report’s author.

It is also unknown whether anyone exploited the flaw before disclosure. NebuSec says it has seen no real attacks, but that statement does not establish that none occurred. The report identifies affected Android versions, while the status of iOS, desktop and group calling remains unclear. No CVE had been assigned as of October 29, and the source material reports no public Telegram statement addressing the allegations.

Update and Watch for Details

Telegram users on Android should install the latest available app update and check that the version shown in Telegram’s Settings is 12.10.4 or later, as specified in the source report. Until updated, users can set “Who can call me?” to “My Contacts” or “Nobody” and decline calls from unfamiliar accounts. These steps reduce exposure to unwanted calls; they do not verify or disprove NebuSec’s exploit claims.

Organizations should confirm minimum Telegram versions on managed Android devices and decide whether to restrict messenger calling under their existing policies. Further clarity depends on a technical write-up, a response from Telegram, or independent analysis of the reported exploit chain. Until then, the reported code fix is a concrete reason to update, while the extent of the risk remains uncertain.

Key Questions

Which Telegram Android versions does NebuSec say are affected?

NebuSec identifies versions 8.6.2 through 12.10.3 as affected and says the issue is fixed in version 12.10.4. Check Telegram’s Settings for the installed version and update to the latest available release.

Does the reported attack work without answering a call?

According to NebuSec, the user has to answer, making the reported attack one-click rather than zero-click. The full exploit chain has not been independently verified in the public evidence described by the source material.

What should I do if I cannot update right away?

Set Telegram’s “Who can call me?” control to “My Contacts” or “Nobody,” and decline calls from unfamiliar people until you can update. These are precautionary steps, not proof that your device has been targeted.

Were iPhones, computers or group calls affected?

The available account does not establish that they were. NebuSec said it had no evidence that iOS, desktop apps or group calls were directly affected, and the source material says the status of those platforms has not been shown conclusively.

Is there evidence attackers used the flaw?

NebuSec says it has seen no real attacks. The source material reports no public exploitation listing, but it remains unknown whether the flaw was used before disclosure; lack of observed attacks does not prove that none occurred.

Source: ThorstenMeyerAI.com