Telegram Android Voice Call Vulnerability Allowed Code Execution
A critical flaw in Telegram for Android allowed attackers to execute arbitrary code on a user's device by simply answering a voice call, with a patch now available.
A significant vulnerability discovered in Telegram's Android application allowed attackers to execute arbitrary code on a victim's device simply by initiating and having the victim answer a voice call. The security startup NebuSec disclosed the flaw, which required only a standard Telegram account to exploit, on October 29, 2026.
The vulnerability affected all versions of the Telegram for Android app from 8.6.2 through 12.10.3, a range spanning from March 2022 to September 2026. NebuSec confirmed the exploit's effectiveness on ARM64-based phones but stated they had no evidence of it impacting Telegram's iOS or desktop applications, nor did it appear to affect group calls. Users are strongly advised to update their Telegram for Android app to version 12.10.4 or later, where the issue has been resolved.
The technical details reveal that the flaw resided within the code responsible for processing MediaState messages, which are used during call setup and to report call status like microphone mute or camera orientation. Specifically, the vulnerable code failed to correctly handle missing fields within these messages, leading to memory access violations. A review of Telegram's published source code for version 12.10.3 by The Hacker News corroborated this description, showing how the application would incorrectly attempt to read a video state field even if it was absent from the message.
Telegram addressed the vulnerability in version 12.10.4, released in late September 2026. The fix involved correcting how the rotation value was read from the message. Notably, the underlying calling code that could be exploited was introduced in version 8.6.2. The shared tgcalls library, used across Telegram's Android, iOS, and desktop applications for handling calls, received a related fix labeled "Fix camera rotation" on April 21, 2026. This correction was integrated into the iOS app in version 12.7 (May 2026) and the desktop app in version 7.0.1 (July 2026), with the Android app receiving the patch in version 12.10.4 (September 2026).
NebuSec provided a demonstration video showcasing the exploit. In the video, an attacker initiates a call to a victim's phone. Shortly after the victim answers, the victim's phone screen transitions to the home screen, app icons fall, and a "HACKED BY NEBUSEC" logo appears. While the video did not specify the exact Android or Telegram versions used on the victim's device, it visually confirmed the potential for a complete system compromise.
As of October 29, 2026, the vulnerability had not been assigned a CVE identifier. The Hacker News had reached out to NebuSec and Telegram for information regarding whether the flaw had been exploited in real-world attacks and for further details on the extent of code execution capabilities on a compromised phone. NebuSec, a Y Combinator-backed startup, indicated that its Code Security product, powered by OpenAI's GPT-5.4 model, was responsible for discovering this vulnerability.
This incident highlights the persistent security risks associated with mobile messaging applications, even those known for their security features. The ability for a simple voice call to trigger a remote code execution underscores the need for continuous vigilance and prompt patching of vulnerabilities in widely used communication platforms. Users are urged to maintain updated applications to protect themselves from such threats.