Summary
A flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security st…
A flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec.
The attacker needed only an ordinary Telegram account. Telegram fixed the flaw in version 12.10.4 of the app, released in late September, and NebuSec disclosed it on October 29.
The flaw can be triggered in every version from 8.6.2 through 12.10.3, NebuSec's co-founder and chief executive said in an email to The Hacker News. Those versions came out between March 2022 and September 2026.
The company confirmed it in private phone calls on ARM64-based phones and has no evidence so far that it directly affects Telegram's iOS and desktop apps or group calls.
Anyone using Telegram for Android should make sure the app is on version 12.10.4 or later. The version number appears at the bottom of the app's Settings page. The flaw had no CVE identifier as of October 29.
The Hacker News has asked NebuSec and Telegram whether the flaw was used in real attacks, and asked NebuSec what an attacker's code could reach on a phone.
During a Telegram call, the two apps send each other short messages to set up the call and report its state. One type, called MediaState, reports whether the microphone is muted, whether the camera is on, and how the video is rotated.
The flaw was in the code that reads MediaState messages. That code did not handle missing fields correctly and accessed memory it should not, according to NebuSec.
Telegram's published source code for version 12.10.3 contains a flaw that matches that description, a review by The Hacker News found. When a MediaState message included a rotation value, the code checked that value. It then read a different field, the video state, even if the message had no such field.
Version 12.10.4 reads the rotation value from the right field. The calling code that uses this message was switched on in version 8.6.2, the first version NebuSec names.
Telegram's Android, iOS, and desktop apps use one shared library, called tgcalls, for calls. A change labeled "Fix camera rotation" made the same correction in tgcalls on April 21, 2026.
Telegram's iOS source code included that change from version 12.7, released in May, and the desktop app's code from version 7.0.1, released in July. Telegram for Android received it in version 12.10.4 in September.
Whether the earlier code could be exploited in those apps has not been shown.
NebuSec's video shows two phones, one marked as the attacker and one as the victim. The victim accepts a Telegram call. About half a minute into the call, the victim's phone switches to its home screen, the app icons fall down the screen, and a "HACKED BY NEBUSEC" logo appears.
The video does not show which Telegram or Android version the victim's phone was running. No technical write-up of the flaw was on NebuSec's website as of October 29, so the step from the flaw to running code depends on the video and on what the company says.
NebuSec, a startup backed by Y Combinator, says its Code Security product, which runs on OpenAI's GPT-5.4 model, found the flaw. In July, the company described an Android exploit chain that started with a Firefox flaw and reached the kernel of an ARM64 device running Android 17.
Separately, the Zero Day Initiative (ZDI) published an advisory on October 15 about an unpatched flaw in rlottie, the library Telegram apps have used to draw animated stickers. The flaw, tracked as CVE-2026-111105 (CVSS score: 7.0), can let an attacker run code if a user opens a malicious file or page, ZDI said.
Telegram had told ZDI in March that checks on its servers mitigated the flaw, and in April asked ZDI for a full remote code execution chain.
Those checks could be bypassed, researcher Saifeldeen Aziz says in the abstract for his OffensiveCon talk in Tokyo. The research used AI-guided fuzzing, which feeds code with large amounts of broken or unexpected input, to find memory-corruption bugs in rlottie across Telegram's iOS, Android, and desktop apps. It then chained those bugs, which stem from flaws in how stickers are delivered and checked, to run code on Telegram for iOS.
The Android app replaced rlottie with tlottie, a library written in Rust, between versions 12.8.1 in June and 12.10.0 in August, according to Telegram's published source code. The desktop app's code made the same switch in September, and the iOS code added tlottie in version 13.0 in October while still including rlottie.
Source: The Hacker News
