Telegram Android Vulnerability Allows Remote Code Execution via Voice Calls – Users Urged to Update to Version 12.10.4
A critical security vulnerability in Telegram for Android could allow an attacker to execute arbitrary code on a victim’s device simply by initiating a private voice call that the user answers. The flaw, disclosed on October 29, 2026 by cybersecurity startup NebuSec, affected every version of the official Telegram Android app from 8.6.2 through 12.10.3 — a period spanning more than four years.
Telegram silently fixed the underlying issue in version 12.10.4, released in late September 2026. No widespread real-world exploitation has been reported as of November 1, 2026, but security experts strongly recommend that all Android users update immediately.
What Happened?
According to NebuSec, a memory-handling error existed in the code responsible for processing MediaState messages during private voice calls. These messages carry information about microphone status, camera state, and video rotation. When certain fields were missing, the vulnerable code read memory it should not have accessed, creating a pathway for memory corruption.
NebuSec demonstrated that this bug could be chained with an information-leak vulnerability and a known Android root exploit to achieve full device compromise — including access to messages, the microphone, the camera, and other sensitive data.
Affected Versions and Platforms
- Affected: Telegram for Android versions 8.6.2 to 12.10.3 (released between March 2022 and September 2026)
- Fixed: Telegram for Android 12.10.4 and later
- Confirmed on: ARM64-based Android devices
- Not confirmed on: iOS, Telegram Desktop, or group calls
Telegram’s iOS and desktop clients received the corresponding fix in the shared tgcalls library earlier in 2026 (iOS in version 12.7, Desktop in 7.0.1). Android lagged behind and only received the correction in September.
Timeline of the Vulnerability
- March 2022: Vulnerable calling code introduced in Telegram Android 8.6.2
- April 21, 2026: Fix applied in the shared tgcalls library (“Fix camera rotation”)
- May–July 2026: Fix reaches iOS and Desktop clients
- September 17, 2026: Last vulnerable Android version (12.10.3) released
- Late September 2026: Telegram Android 12.10.4 ships with the fix
- September 26, 2026: NebuSec reports the issue to Telegram (after the fix was already available)
- October 29, 2026: Public disclosure by NebuSec with demonstration video
How Dangerous Is This Flaw?
While the vulnerability itself is serious, several factors limited its immediate real-world impact:
- The victim must actively answer the call
- Setting call privacy to “Nobody” completely blocks the attack
- No public proof-of-concept code was released at the time of disclosure
- No confirmed in-the-wild exploitation has been reported
- No CVE identifier was assigned as of late October 2026
Nevertheless, the combination of low attacker requirements (just a normal Telegram account) and the potential for full device takeover makes this a high-priority issue for anyone still running an outdated version.
What Users Should Do Right Now
- Update Telegram for Android to version 12.10.4 or later via the Google Play Store or the official Telegram website.
- Open Telegram → Settings → scroll to the bottom to verify the version number.
- Go to Settings → Privacy and Security → Calls and set “Who can call me” to Nobody or “My Contacts”.
- Decline any unexpected voice calls from unknown accounts until the app is updated.
- Enable Two-Step Verification if you have not already done so.
Official Statements and Industry Reaction
NebuSec stated that it found no evidence the flaw had been exploited in real attacks prior to disclosure. Telegram acknowledged the report but initially disputed that the bug could be turned into reliable remote code execution, which is why no bug bounty was paid and no CVE was issued at the time.
Independent security outlets, including The Hacker News and Cybernews, confirmed the existence of the memory-handling error in Telegram’s publicly available source code for version 12.10.3.
Frequently Asked Questions (AEO-Optimized)
Broader Context: Why This Matters
This incident highlights two recurring themes in mobile messaging security:
- Shared libraries (in this case
tgcalls) can leave one platform lagging behind others in receiving critical fixes. - Memory-safety issues in performance-critical code (call handling) remain a persistent risk even in widely used applications.
Users of any messaging platform should treat unexpected voice or video calls with caution and keep applications updated — especially on Android, where the attack surface is larger.
Comments
Post a Comment