A serious vulnerability in Telegram for Android has been patched, after it was discovered that attackers could run code on victims’ phones merely by having their voice call answered. The flaw, which affects a wide range of Android versions, was fixed in Telegram app version 12.10.4, released in late September 2026.
How the flaw worked
Researchers at NebuSec uncovered the issue. It’s exploitable through any normal Telegram account when the victim answers a voice call. Once connected, an attacker spots a weakness in how Telegram’s Android versions 8.6.2 through 12.10.3 process a message type called MediaState. This message communicates call settings like if the microphone is muted, whether video is on, and how video frames should be oriented.
The vulnerability arises when MediaState messages include a “rotation” value. Telegram would check it—but then proceed to read a different field (`video_state`) even if that field was missing. That allows memory access where there shouldn’t be any, opening the door to arbitrary code execution. The issue was present in builds from March 2022 up to version 12.10.3.
Scope, platforms, and visibility
The flaw was confirmed on ARM64-based Android devices. There’s no concrete evidence that it affects Telegram on iOS or desktop, or group calls. A source library shared among Telegram’s Android, iOS, and desktop apps—named tgcalls—contained the correction in its Android branch in version 12.10.4. Parallel fixes were rolled out earlier for iOS (version 12.7) and desktop (version 7.0.1).
Public demonstration video shared by NebuSec showed one phone under attack accepting a Telegram voice call, after which the home screen is triggered and replaced by a “HACKED BY NEBUSEC” logo. The precise Android build or Telegram version on the target device was not shown. As of October 29, there was no formal CVE identifier issued for this bug.
Other Telegram security concerns
Separately, a vulnerability in Telegram’s animated-stickers library—rlottie—was disclosed earlier in October. Labeled CVE-2026-111105 and carrying a CVSS score of 7.0, it could allow code execution if a user viewed a malicious file or page. Telegram later swapped rlottie out for a newer Rust-based library called tlottie in Android version 12.10.0 (August 2026), desktop in September, and iOS in version 13.0. These changes mitigate a similar class of risks.
What you need to do
If you use Telegram on Android, update to version 12.10.4 or higher right away. You can verify your version by going to the Settings screen and looking at the bottom of the page. For those using Telegram on other platforms, it’s wise to stay alert for advisories, though there’s no solid evidence yet of this exploit affecting non-Android apps.
In light of this discovery, it’s clear that even mature, trusted communication apps remain vulnerable to surprisingly subtle bugs. As apps evolve to handle richer media and features, developers must double down on validating all input types—especially optional or experimental fields. Users and enterprises alike should demand rapid patching and transparent disclosure. What to watch next: whether any real-world exploit of this bug emerges, and how Telegram’s security posture adjusts moving forward.
