Telegram for Android flaw ran code after a voice call was answered
Original title: Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls
Versions 8.6.2 through 12.10.3 were affected; 12.10.4, released in late September, fixes MediaState handling, and no CVE was assigned as of October 29.
NebuSec said a flaw in Telegram for Android let an attacker with an ordinary account run code on a victim's phone after the victim answered a voice call. The bug was in parsing MediaState call-setup messages, which could read a missing video-state field. NebuSec confirmed it on ARM64 phones and published a video of a demo; The Hacker News matched the description to Telegram's 12.10.3 source. The same tgcalls correction reached iOS and desktop earlier, but exploitation there has not been shown.
Unconfirmed: NebuSec and Telegram had not said whether the flaw was used in real attacks, and what attacker code could reach was unanswered.
- Affected Android builds span March 2022 through September 2026.
- Users should confirm version 12.10.4 or later at the bottom of Settings.
- NebuSec says its GPT-5.4 Code Security product found the flaw.
- A separate ZDI advisory covers unpatched rlottie issue CVE-2026-111105.
- The demo video does not state the victim phone's Telegram or Android version.
Impact: Code execution on the phone after a voice call is answered
| Product | Affected | Fixed in |
|---|---|---|
| Telegram for Android | 8.6.2 through 12.10.3 | 12.10.4 |
- 1.Update Telegram for Android to version 12.10.4 or later.
- Vendors
- Telegram
- Products
- Telegram for Androidtgcalls
- Organizations
- NebuSec
- AI models
- GPT-5.4
From the original article
3 min read at thehackernews.com
A flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary Telegram account. Telegram fixed the flaw in version 12.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.