TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
NebuSec disclosed a Telegram for Android call-handling flaw on October 29, saying it could be combined with two other bugs to take control of a phone after a user answered a call. Telegram Android 12.10.4, released in September, contains a correction to the call code, but NebuSec has not published a technical report and says it has seen no attacks.
Security startup NebuSec disclosed a flaw in Telegram for Android on October 29, saying it could help an attacker take control of a phone after the user answered a call. The company says Telegram fixed the reported call-code issue in version 12.10.4, released in September; however, the claimed full attack chain has not been detailed in a public technical report.
NebuSec says the flaw affected Telegram for Android versions 8.6.2 through 12.10.3. According to the startup’s chief executive, Eten Zou, the call bug needed to be combined with two other bugs: one that exposed information and an Android privilege-escalation exploit. NebuSec says the chain worked in private voice calls on ARM64 phones and could give an attacker broad control of the device. Those claims have not been independently demonstrated in the material cited here.
The company announced the issue on X and showed a short video of a victim phone changing screens after a call connected. The video does not identify the Telegram or Android version on the device. NebuSec told The Hacker News that it reported the flaw to Telegram on September 26. Zou said Telegram acknowledged the report but questioned whether the issue could lead to remote code execution. Telegram had not made a public statement as of October 29, according to the source material.
A comparison of Telegram’s public Android source code for versions 12.10.3 and 12.10.4 found a change in how call status messages are handled. The earlier code checked for a video-rotation value but read a different field that might be absent; the later code reads the checked field. The source material says Telegram’s shared call library received a similar correction in April, before the Android release. This code change supports the existence of a call-code defect, but by itself does not verify NebuSec’s claimed three-bug chain or full device takeover.
Security Briefing · October 29, 2026
Telegram Android Flaw: What’s Known, What’s Unclear, and What to Do
NebuSec says a call-handling flaw could be combined with two other bugs to take control of a phone after a user answered. Telegram Android 12.10.4 includes a correction to the call code. The full attack chain remains undocumented publicly.
“Now picking up a wrong call can get you hacked.”
NebuSec · October 29 post on XWhat the public record supports
A source comparison found a call-code correction between Android versions 12.10.3 and 12.10.4. That supports the existence of a defect; it does not prove the broader takeover claim.
A field mismatch was corrected
Version 12.10.3 checked a video-rotation value but read a different field that might be absent. Version 12.10.4 reads the checked field.
Three bugs formed a chain
NebuSec says the call flaw combined with an information disclosure bug and an Android privilege-escalation exploit on ARM64 phones in private voice calls.
Full device control is unverified
No public technical report details the additional bugs, exact conditions, or claimed access. The short video does not identify the device software versions.
Answering is the trigger in NebuSec’s account
If the chain works as described, the required user action makes this a one-click scenario—not a zero-click attack.
Keep the correction and the claim distinct
Public code, company statements, and missing details answer different questions. The available record is incomplete.
| Question | Public information | Status |
|---|---|---|
| Which Android versions? | NebuSec names 8.6.2 through 12.10.3 as affected; 12.10.4 contains the correction. | Reported range |
| Does answering alone prove takeover? | No. NebuSec says two additional bugs were needed; the full chain has no public technical write-up. | Unverified |
| Was it used in real attacks? | NebuSec says it has seen no real-world attacks. | No attacks observed by NebuSec |
| Is there a CVE or KEV entry? | The cited U.S. records had no CVE entry or known-exploited-vulnerability listing as of the dates checked. | No listing reported |
| Were iOS, desktop, or group calls affected? | The source material does not establish exploitability on those platforms or in group calls. | Unknown |
| Telegram’s public assessment? | NebuSec says Telegram acknowledged the report and questioned whether it enabled remote code execution. No public Telegram statement was reported by October 29. | Unclear |
The correction predates disclosure
Telegram’s public Android source allows version comparisons. The shared call library received a similar correction months earlier.
Update now; use call limits as a bridge
These steps reduce exposure while the public technical record remains incomplete.
For Android users
Check the version at the bottom of Telegram’s Settings and install 12.10.4 or later if available. Until updated, restrict incoming calls to contacts or nobody, and decline unexpected calls. Call settings are interim precautions, not proof that every route is blocked.
For organizations
Check Telegram versions on managed devices and set a minimum permitted version. Because the issue has no CVE identifier in the cited material, teams relying only on CVE feeds may not flag affected app versions.
Details that would resolve the open questions
The next useful step is reproducible technical evidence that connects the code correction to the broader claim.
Show the full chain
Identify the device and software versions, explain each bug’s role, and provide reproducible evidence for the claimed outcome.
Clarify the assessment
A public response could explain Telegram’s view of the report and whether other versions or call types are affected.
Track new disclosures
No CVE or cited U.S. known-exploited-vulnerabilities listing was reported as of October 29, 2026. Those absences do not establish that exploitation is impossible.
From code change to user action
Three links separate what is observed from what is alleged and what users can do today.
Why Call Access Matters
If NebuSec’s account of the full chain is accurate, answering an unexpected call could serve as the user action that lets an attacker begin exploiting the phone. That would put the risk in a familiar feature people may answer without expecting to install a file or open a link. NebuSec describes the scenario as a one-click attack; it is not zero-click because the user must answer.
The immediate practical step is to update Telegram for Android to version 12.10.4 or later. Until updated, users can limit incoming calls to contacts or nobody in Telegram’s call privacy settings and decline calls from unknown callers. The source material does not establish that changing this setting prevents every possible route to exploitation.
For organizations, the episode highlights a gap in vulnerability tracking: the issue has no CVE identifier, according to the source material. Employers that rely only on CVE feeds may not flag the affected app versions. They can check installed Telegram versions on managed devices and set a minimum permitted version while the technical record remains incomplete.
Products Worth Considering
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Jackery HomePower 3000 Portable Power Station with Two 200W Solar Panels
As an affiliate, we earn on qualifying purchases.
The Fix Predates Disclosure
NebuSec disclosed the issue publicly on October 29, 2026. Telegram Android 12.10.4 was released in September, and the source material identifies September 24 as the date the fixed Android source appeared. The underlying shared call library, tgcalls, had received a correction on April 21 in a change titled “Fix camera rotation.” The source author says the Android fix appeared 156 days after that shared-library change.
Telegram publishes its Android source code publicly, allowing a comparison between the two app versions. The author’s review found a mismatch between the field the code checked and the field it read in version 12.10.3, corrected in 12.10.4. The source material also says The Hacker News reported that iOS incorporated the shared change in May and desktop in July. That timing does not establish whether those apps were exploitable; NebuSec had no evidence that iOS or desktop apps, or group calls, were directly affected.
As of October 29, the source material reports no CVE entry in the U.S. National Vulnerability Database and no Telegram listing in the Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog, checked against its October 28 version. Those absences describe the public records checked; they do not prove that exploitation is impossible or that no private reports exist.
“Now picking up a wrong call can get you hacked.”
— NebuSec, in its October 29 post on X
What the Public Evidence Shows
The claimed chain has not been independently verified in a public technical write-up. NebuSec’s short video does not show the Telegram or Android versions used, and the source material says the company’s research page had no detailed report as of October 29. The two additional bugs, the precise conditions needed to exploit them, and the claimed extent of device access remain unconfirmed in the material available.
NebuSec says it saw no real-world attacks. There is no CVE number or entry in the cited U.S. vulnerability records as of the dates checked. The source material also does not establish whether the older versions could be exploited on other platforms, in group calls, or across all Android devices. Telegram’s public response, if any, and its assessment of the report remain unknown.
Update and Watch for Details
Android users should check the version shown at the bottom of Telegram’s Settings and install version 12.10.4 or later if available. Users who cannot update immediately can restrict who may call them and avoid answering unexpected calls, while recognizing that these steps are interim precautions rather than confirmation of a complete fix.
The next useful evidence would be a detailed technical report from NebuSec, including the affected device and software versions, the role of each claimed bug, and reproducible evidence for the full chain. A public response from Telegram could clarify its assessment and whether any other app versions are affected. Until then, the confirmed code correction and the broader takeover claim should be treated as distinct parts of the story.
Key Questions
Which Telegram Android versions does NebuSec say were affected?
NebuSec says the affected range was versions 8.6.2 through 12.10.3. The source material identifies 12.10.4 as containing the correction.
Does answering a call alone prove that a phone can be taken over?
No. NebuSec says the call flaw had to be combined with two other bugs to achieve full control. The complete chain has not been documented in a public technical report in the source material.
What should Android users do?
Update Telegram to 12.10.4 or later and check the installed version in Settings. Until updated, users can limit who may call them and decline calls from people they do not recognize.
Is there evidence the flaw was used in real attacks?
NebuSec says it has seen no real-world attacks. The source material reports no CVE or listing in the cited U.S. known-exploited-vulnerabilities catalog as of October 29, 2026.
Were Telegram on iPhone or desktop affected?
The source material does not establish that iOS or desktop versions were exploitable. It says NebuSec had no evidence that those apps or group calls were directly affected, while noting that related call-library changes reached other platforms.
Source: Thorsten Meyer AI
