Why Answering A Call Is Central To The Telegram Android Flaw

🔍 Read the full analysis: Why Answering A Call Is Central To The Telegram Android Flaw on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on office and shipping supplies

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android call-handling code on October 29, saying attackers could use it as the first step in a chain that takes control of a phone after a user answers an incoming call. Telegram’s version 12.10.4 contains a fix, but NebuSec’s account of the additional bugs needed for a full takeover has not been documented in a public technical report.

NebuSec says the issue affected Telegram for Android versions 8.6.2 through 12.10.3, released from March 2022 to September 2026, and was fixed in version 12.10.4. The company described the vulnerability as an entry point rather than a complete attack by itself: according to its chief executive, Eten Zou, attackers would also need an information-leaking bug and an Android root exploit to gain full control of a device.

Zou told The Hacker News that NebuSec tested the chain in private voice calls on ARM64 phones. The source material describes a short demonstration video in which a victim phone appears to be compromised after a call connects. It does not identify the Telegram or Android versions used in the demonstration. NebuSec said it had not seen real-world attacks; that is the company’s reported observation, not evidence that the flaw was never used.

A comparison of Telegram’s published Android source code for versions 12.10.3 and 12.10.4 found a change in how call messages handle video-rotation data. In the earlier code, the app checked for one field but then read a different field that might be absent. The fixed version reads the field it checked. The source material says the fix had also appeared in Telegram’s shared call library in April 2026, before the Android update. No CVE identifier had been assigned as of October 29, and the source material reports no public Telegram statement responding to the disclosure.

Why Answering the Call Matters

The detail that makes this report stand out is the user action required. NebuSec’s account does not describe a zero-click attack that compromises a phone merely by delivering a call. The person must answer, making the reported flaw an example of a one-click attack path—a routine action that could connect an incoming call to vulnerable code.

Call features have to process information from another account to establish and manage a connection. That creates a security boundary even before a conversation begins. Google Project Zero wrote in 2018 that picking up a call is “a reasonable action to expect a user to take.” The observation helps explain why call-handling code can be a target, but it does not independently verify NebuSec’s account of this particular exploit chain.

For individual users, the practical issue is straightforward: devices running affected versions should be updated. For organizations, the absence of a CVE may limit visibility for security tools and processes that rely on vulnerability identifiers. The report therefore raises a patch-management concern as well as a question about the underlying attack.

Products Worth Considering

Brother TD-2020A 2‑Inch Direct Thermal Desktop Label Printer with USB

AmazonView Latest Price

Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo

AmazonView Latest Price

Apple iPad Air (2025) 13‑inch Wi‑Fi 256 GB – Space Gray (M3 chip)

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

A Fix Before Public Disclosure

NebuSec announced the flaw on October 29, saying it had reported it to Telegram on September 26. According to Zou, Telegram acknowledged the report but did not agree that the issue could be turned into remote code execution, or code run by an attacker on a victim’s device. Zou said no CVE was assigned and no bounty was paid. The Hacker News sought comment from Telegram; the source material says no public reply was found.

The version history complicates the timeline. Telegram’s shared call library, tgcalls, received a correction on April 21, 2026, in a change titled “Fix camera rotation.” The Android source with the correction appeared later, in version 12.10.4. The source material says The Hacker News reported that iOS received the change in May and desktop in July, but it does not establish whether older versions on those platforms were exploitable. NebuSec said it had no evidence that iOS, desktop or group calls were directly affected.

As of October 29, the source material reports that the U.S. National Vulnerability Database had no CVE entry for the flaw and that the Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog, dated October 28, had no Telegram entry. Those absences describe the listings at that time; they do not prove that exploitation was impossible.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in a post announcing the flaw on X

What the Public Evidence Shows

The central uncertainty is the gap between the call-code bug and the claimed full takeover. The source material says the code change in Telegram’s Android app can be inspected, but the two additional bugs, their interaction and the complete exploit chain have not been laid out in a public technical write-up. The demo video is short and does not disclose the software versions shown.

It is also not clear whether the chain works against a current, fully patched Android device, whether anyone exploited it before disclosure, or whether other Telegram platforms were vulnerable to equivalent attacks. NebuSec reported no attacks it had seen; that statement cannot establish that no attacks occurred. Telegram had not publicly addressed the claims in the material available as of October 29.

Update and Watch for Detail

Android users can check Telegram’s version in the app’s Settings and update to 12.10.4 or later. Until updated, the source report recommends restricting who can call an account to contacts or nobody, and declining calls from unfamiliar accounts. These steps reduce exposure to unwanted calls; they do not confirm or disprove the reported exploit chain.

For organizations, the immediate steps are to check minimum Telegram versions on managed phones and not rely solely on CVE-based alerts to identify app vulnerabilities. Further clarity depends on whether NebuSec publishes technical details, Telegram comments publicly, or independent researchers reproduce the full chain. Those details would help establish the scope, affected platforms and whether the reported route reaches a fully patched device.

Key Questions

What is the Telegram Android flaw?

NebuSec says a bug in Telegram’s Android call-handling code could serve as the first step in an attack. The company says an attacker would need two additional bugs to take full control of a phone.

Does the attack work without answering a call?

According to NebuSec’s description, the victim must answer an incoming call. The report therefore describes a one-click attack path, not a zero-click compromise.

Which Telegram versions are reported as affected?

NebuSec identified Telegram for Android versions 8.6.2 through 12.10.3 as affected and said version 12.10.4 fixed the issue. Users should check for a later version and update.

Has the flaw been used in real attacks?

NebuSec said it had seen no real-world attacks. The source material says there was no CVE entry or listing in the U.S. known-exploited-vulnerabilities catalog as of October 29, 2026. Those facts do not prove the flaw was never exploited.

Are Telegram on iPhone or desktop affected?

The material does not establish that iOS or desktop versions were exploitable. It says Telegram’s shared call library received a correction and that other platforms later incorporated it, but NebuSec had no evidence that those apps were directly affected.

Source: ThorstenMeyerAI.com