Telegram for Android Flaw Let Attackers Run Code Through a Voice Call

A flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec. All the attacker needed was an ordinary Telegram account.

Telegram fixed the bug in version 12.10.4, released in late September, and NebuSec disclosed it on October 29. According to the company's co-founder and CEO, the flaw is present in every version from 8.6.2 through 12.10.3 — releases spanning March 2022 to September 2026. NebuSec confirmed it in private calls on ARM64 phones and has no evidence so far that it directly affects the iOS and desktop apps or group calls.

Android users should make sure they are running version 12.10.4 or later; the version number is shown at the bottom of the Settings page. As of October 29, the flaw had no CVE identifier. The Hacker News has asked NebuSec and Telegram whether it was exploited in real attacks.

What went wrong

During a call, the two apps exchange short control messages. One of them, MediaState, reports whether the microphone is muted, whether the camera is on, and how the video is rotated. According to NebuSec, the code parsing MediaState mishandled missing fields and accessed memory it should not have.

The Hacker News reviewed the published source of version 12.10.3 and found a matching bug: when a message included a rotation value, the code checked it but then read a different field — the video state — even if the message contained no such field. Version 12.10.4 reads rotation from the correct field.

Telegram's Android, iOS, and desktop apps share a calling library called tgcalls. A fix labeled "Fix camera rotation" landed there on April 21, 2026, reached the iOS code in version 12.7 (May) and the desktop code in 7.0.1 (July). Android only got it in September. Whether the older code was exploitable on the other platforms has not been shown.

The demo and the AI

NebuSec published a video: the victim accepts a call, and about half a minute in, the phone jumps to its home screen, the app icons tumble down, and a "HACKED BY NEBUSEC" logo appears. The video does not show the Telegram or Android version, and as of October 29 no technical write-up was on the company's site, so the step from bug to code execution rests on the video and the company's word.

NebuSec, a Y Combinator-backed startup, says its Code Security product, built on OpenAI's GPT-5.4 model, found the flaw.

Meanwhile, in stickers

Separately, the Zero Day Initiative on October 15 published an advisory on an unpatched flaw, CVE-2026-111105 (CVSS 7.0), in rlottie, the library Telegram uses to render animated stickers. Telegram had said server-side checks mitigated the risk, but researcher Saifeldeen Aziz says they can be bypassed: using AI-guided fuzzing, he found memory-corruption bugs and chained them to run code on Telegram for iOS. The Android app has since switched to tlottie, a Rust library; the desktop app followed in September, and the iOS app added it in 13.0 while still keeping rlottie.

Source: The Hacker News