When Answering The Call Is The Attack: What We Know About Telegram’s Android Flaw, And What To Do Now

🔍 Read the full analysis: When Answering The Call Is The Attack: What We Know About Telegram’s Android Flaw, And What To Do Now on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android voice-call code on October 29, saying an attacker could use it as part of a chain of three bugs to gain control of a phone after the recipient answered a call. Telegram’s Android version 12.10.4, released in September, contains a correction to the call code; the full attack chain has not been independently documented in a public technical report.

NebuSec chief executive Eten Zou told The Hacker News that the call-code flaw was not sufficient on its own. The company says it combined the bug with a second issue that leaked information, then an Android root exploit that could grant administrator-level access. If that account is accurate, the chain could expose a victim’s messages, microphone and camera. NebuSec says its testing used private voice calls on ARM64 phones, a processor architecture common in modern Android devices.

The company announced the issue on X with a short demonstration video. It reported the flaw to Telegram on September 26, Zou said, shortly after Telegram had published the fixed Android version. According to Zou, Telegram acknowledged the report but did not consider the bug capable of remote code execution. He said no CVE was assigned and no bounty was paid. The Hacker News sought comment from Telegram; the source material reports no public response.

A comparison of Telegram’s published Android source code for versions 12.10.3 and 12.10.4 found a change in how call status messages are handled. The earlier code checked that a camera-rotation value existed, then read a separate video-state field that a message did not necessarily contain. The later code reads the rotation field instead. That supports the existence of a relevant code correction, but does not independently establish that the reported chain could take over a phone.

Why Call Handling Draws Security Risks

Voice calls are designed to receive data from another account before the recipient has decided whether to trust the caller. That makes call setup and status handling an exposed part of a messaging app: the software must process incoming information for a call to ring and connect. A mistake in that processing can matter even when the user takes an ordinary action, such as answering.

For users, the practical step is straightforward: update Telegram for Android and check that the version shown at the bottom of Settings is 12.10.4 or later. Until updated, the source recommends limiting “Who can call me?” to My Contacts or Nobody and declining calls from unknown accounts. The report does not establish that answering any unfamiliar Telegram call will compromise a device; the claim concerns a specific vulnerable app version and a chain involving additional bugs.

The case also illustrates a gap in vulnerability tracking. With no CVE listed, organisations whose security processes rely only on CVE feeds may not flag the issue. Businesses can reduce that blind spot by setting minimum app versions on managed phones and applying a messenger policy that includes timely updates, rather than relying solely on vulnerability databases.

Products Worth Considering

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

Logitech MX Brio Ultra HD 4K Webcam, Graphite

AmazonView Latest Price

DJI Osmo Pocket 3 Creator Combo Vlogging Camera with 1 CMOS & 4K/120fps

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates the Disclosure

NebuSec’s account places the affected Android range at versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. The company identifies 12.10.4 as the fixed release. The source material’s review of Telegram’s public code found that the shared call library, tgcalls, received a similar correction on April 21, 2026, under a change titled “Fix camera rotation.” The Android source with the correction appeared later, on September 24, according to that review.

Telegram’s shared call library is used across its Android, iOS and desktop apps. The source material, citing The Hacker News, says the iOS app incorporated the change in May and the desktop app in July. That does not establish that those versions were exploitable: NebuSec said it had no evidence that iOS, desktop or group calls were directly affected. The reported vulnerability is specifically framed around Telegram for Android voice calls.

As of October 29, the source material found no CVE entry in the U.S. National Vulnerability Database and no Telegram listing in the Cybersecurity and Infrastructure Security Agency’s known exploited vulnerabilities catalog, using the catalog version dated October 28. Those absences indicate there was no listing in those sources at that time; they do not prove the bug was never exploited.

“Now picking up a wrong call can get you hacked.”

— NebuSec post on X

What the Public Evidence Cannot Show

NebuSec has not published a detailed technical write-up of this flaw, and the source material says the company reported no real-world attacks observed. The demonstration video shows a call connecting and a phone displaying a “HACKED BY NEBUSEC” screen, but it does not identify the Telegram or Android versions running on the victim device. The video alone does not establish how the exploit worked or whether every part of the claimed chain was involved.

The underlying call-code correction can be seen in Telegram’s public source, but the source review could not verify the two additional bugs NebuSec says were needed. It also could not establish whether the chain works against a fully patched, current Android installation, whether anyone used the issue before disclosure, or whether other Telegram platforms were vulnerable. NebuSec’s statement that it has seen no attacks is not proof that no exploitation occurred.

There is also no public Telegram statement in the material provided. The company’s position on the report, the scope of its assessment and its reasons for treating the correction as a camera issue rather than a security vulnerability remain unconfirmed beyond Zou’s account.

Update Devices and Watch for Details

Android users should install Telegram 12.10.4 or later and verify the installed version in the app’s Settings. People unable to update immediately can restrict incoming calls to contacts or disable them, then avoid answering calls from unfamiliar accounts until their app is current. Organisations with managed Android devices can set a minimum Telegram version and check compliance.

The next useful development would be a technical account from NebuSec or Telegram describing the vulnerable code, the other bugs in the alleged chain, and the affected Android and app configurations. A public response from Telegram could clarify its assessment and the timing of the fix. Until then, the code comparison supports that a relevant correction was made, while the claimed full phone takeover remains based on NebuSec’s account and demonstration.

Key Questions

Which Telegram version contains the reported fix?

The source material identifies Telegram for Android version 12.10.4 as the fixed release. Users should install that version or a later one and check the version listed in the app’s Settings.

Could answering a Telegram call alone take over a phone?

NebuSec says the call-code flaw needed to be combined with two additional bugs to achieve full control. The public material does not independently verify that chain, so it does not establish that answering a call by itself was enough.

Were iPhone or desktop Telegram apps affected?

NebuSec said it had no evidence that the iOS or desktop apps, or group calls, were directly affected. A similar correction appeared in shared call code, but the available information does not show that those platforms were exploitable.

Has the flaw been used in real attacks?

NebuSec said it had seen no real attacks. The source material found no related CVE or listing in the U.S. known exploited vulnerabilities catalog as of October 29, 2026. Neither fact proves that exploitation never occurred.

Source: ThorstenMeyerAI.com