TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Security startup NebuSec disclosed a Telegram for Android call-code flaw on October 29, saying it could be combined with two other bugs to take control of a phone after the user answered a call. Telegram’s Android version 12.10.4, released in September, contains a code change that the source material identifies as the fix; NebuSec says it has seen no attacks. The full exploit chain has not been independently documented in a public technical report.
Security startup NebuSec disclosed a flaw in Telegram for Android on October 29, saying an attacker could use it as part of a chain of bugs to take control of a phone after its owner answered a call. The reported call-code issue was fixed in Telegram Android version 12.10.4, released in September, but NebuSec’s account of the full attack chain has not been backed by a public technical write-up, and the company says it has seen no real-world attacks.
NebuSec chief executive Eten Zou told The Hacker News that the call bug alone was not enough to compromise a device. He said it could be combined with a second bug that leaked information to escape the Telegram app, then with a separate Android root exploit to gain administrator-level access. The claimed result would include access to messages, the microphone and the camera. NebuSec said the attacker needed an ordinary Telegram account and that the attack worked in private voice calls on ARM64 phones.
The supplied source reports that NebuSec disclosed the issue on X with a short demonstration video. The clip shows a call connecting on a phone labelled as the victim’s, followed by the device returning to its home screen. It does not identify the Telegram or Android versions used, and the source says NebuSec had not published a technical report detailing the flaw or the additional bugs. The video and Zou’s account are therefore evidence of what NebuSec claims, not independent confirmation of the complete exploit chain.
The source’s review of Telegram’s public Android code found a change between versions 12.10.3 and 12.10.4 in how call-status messages handle a video-rotation value. It describes the earlier code as checking that one field existed before reading a different field that might be absent; the newer code reads the checked field. Telegram acknowledged NebuSec’s report, Zou said, but reportedly did not agree that the issue enabled remote code execution. The source says no CVE was assigned and no bounty was paid.
Why Call Access Raises the Stakes
The reported flaw matters because answering a call is an ordinary action, not an unusual link or file download. If NebuSec’s account of the chain is accurate, a person who simply answers a Telegram call could trigger the first step of an attack. The alleged consequences—access to private messages and phone sensors—would make the issue relevant to anyone using Telegram on an unpatched Android device, including people who rely on the app for sensitive communications.
There are limits to what can be concluded. The source says NebuSec reported no attacks, and it does not provide a public technical account sufficient to verify the whole chain. Still, the reported code correction gives Android users a practical response: update Telegram, and, if an update is not immediately possible, restrict who can call them. For organizations, the episode also shows why app-version controls matter: a flaw without a CVE may not appear in vulnerability-monitoring tools that rely on CVE records.
Products Worth Considering
Ring Alarm 5-Piece Wireless Security System
Ring Alarm 8-Piece Kit (2nd Gen) Home Security System
Ring Alarm 14-Piece Wireless Security System
As an affiliate, we earn on qualifying purchases.
A Fix Before Public Disclosure
NebuSec said it reported the issue to Telegram on September 26, shortly after version 12.10.4 had appeared. The source’s code review places version 12.10.3 on September 17 and version 12.10.4 on September 24. It also says Telegram’s shared call library received a similar correction on April 21, 2026, under a change titled “Fix camera rotation”; the Android source with the correction appeared later. The source interprets this sequence as a change initially treated as a camera issue rather than a security fix.
The source reports no CVE for the flaw in the U.S. National Vulnerability Database as of October 29 and no related Telegram entry in the Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog version dated October 28. Those absences do not establish that a flaw is harmless or that no attack occurred; they indicate that the source found no such public listing at the time. It also reports that the shared call library is used by Telegram’s Android, iOS and desktop apps, but does not establish that those other platforms are vulnerable.
“The call bug was combined with a second bug that leaks information and a third Android root exploit.”
— Eten Zou, NebuSec chief executive, speaking to The Hacker News
What the Public Evidence Shows
The central uncertainty is whether the reported bug could be combined with the other two issues as NebuSec describes. The source says it could verify a change in Telegram’s public Android code, but it could not check the additional bugs or independently reproduce the complete chain. The demonstration video does not identify the software versions on the phones, and the company had not published a detailed technical write-up as of October 29.
It is also unclear from the supplied material whether the older code was exploitable on iOS or desktop, whether group calls were affected, and which Android versions or device configurations would be required. The source says NebuSec found no evidence of real-world attacks. It reports no CVE and no listing in the cited government databases, but those facts alone do not settle whether attacks took place or how widely the issue could be exploited. The source also says it found no public Telegram statement.
Update and Restrict Incoming Calls
Android users should install the latest Telegram update and check the version shown at the bottom of the app’s Settings screen. The source identifies version 12.10.4 or later as the relevant protection. If a user cannot update right away, it recommends setting “Who can call me?” to My Contacts or Nobody and declining calls from unfamiliar accounts. These steps reduce exposure to the call-based scenario described by NebuSec; they do not verify or rule out other security issues.
Organizations should check Telegram versions on managed Android phones and set a minimum app-version policy, rather than relying only on CVE alerts. Further confirmation would depend on a technical report, Telegram’s public response, or independent analysis that establishes the exploit chain and its affected devices. Until then, the reported Android code fix is clear, while the claimed full-device compromise remains an account attributed to NebuSec.
Key Questions
Which Telegram Android version includes the reported fix?
The source identifies Telegram Android 12.10.4 as the version containing the relevant code correction. It recommends updating to that version or later and checking the version shown in the app’s Settings screen.
Could simply answering a Telegram call compromise a phone?
NebuSec says answering a call could trigger the first step of an attack when the call flaw was combined with two other bugs. The full chain has not been independently confirmed in a public technical report, so this remains an attributed claim rather than a fully verified finding.
Has NebuSec reported attacks in the wild?
No. The source says NebuSec reported no evidence of real-world attacks as of its October 29 disclosure. That is the company’s reported assessment, not proof that exploitation never occurred.
Are Telegram on iPhone or desktop devices affected?
The supplied material does not establish that iOS or desktop apps are affected. Although Telegram’s shared call library is used across platforms, the source says exploitability on those apps has not been shown.
What should users do if they cannot update now?
Set Telegram’s “Who can call me?” control to My Contacts or Nobody, and decline calls from unfamiliar accounts until the app is updated. These are precautionary steps based on the scenario NebuSec described.
Source: Thorsten Meyer AI
