A flaw in Telegram for Android could let an attacker execute code on a victim’s phone after the victim answered a voice call, security startup NebuSec says. The attacker needed only a standard Telegram account, while no evidence has been reported that the issue was exploited in real-world attacks. The Hacker News reported the disclosure on Oct. 29, 2026. [6]
The affected versions are Telegram for Android 8.6.2 through 12.10.3, spanning releases from March 2022 through September 2026. Telegram addressed the problem in version 12.10.4, released in late September. Users can check the installed version at the bottom of Telegram’s Settings page and should update to 12.10.4 or later.
NebuSec traced the issue to Telegram’s handling of MediaState messages used during calls to report microphone, camera and video-rotation status. According to the company, the parser failed to handle missing fields correctly and could read memory it was not supposed to access. The research indicates that a crafted call could turn that memory-safety error into code execution once the recipient accepted the call.
NebuSec demonstrated the attack in a video involving two phones, with the victim device returning to its home screen and displaying a “HACKED BY NEBUSEC” message roughly 30 seconds after the call was answered. The video does not identify the Telegram or Android versions used, and the company had not published a technical proof of concept or detailed write-up as of the disclosure. The Hacker News said it had asked NebuSec and Telegram whether the flaw had been used in attacks and what access attacker-controlled code could obtain. [6]
The issue had no CVE identifier or public CVSS score as of Oct. 29. NebuSec said it confirmed the behavior in private calls on ARM64-based Android phones, but reported no evidence that the same flaw directly affects Telegram’s iOS or desktop applications or group calls. Telegram’s apps share the tgcalls library, and related fixes appeared earlier in iOS and desktop code; whether their older implementations were exploitable was not established. Android users should install the patched release promptly, particularly because the attack requires no special account privileges beyond the ability to place a Telegram call.
