Telegram for Android Flaw Let Attackers Run Code Through a Voice Call

Security startup NebuSec has disclosed a flaw in Telegram for Android that allowed an attacker to run code on a victim's phone through a voice call, once the victim answered. The attacker needed only an ordinary Telegram account. Telegram fixed the problem in version 12.10.4, released in late September, and NebuSec disclosed it on October 29. According to NebuSec, every version from 8.6.2 through 12.10.3 can trigger the flaw. The company confirmed it in private calls on ARM64-based phones and has no evidence so far that it directly affects the iOS app, the desktop app or group calls. No CVE identifier had been assigned as of October 29.

During a call, the two apps exchange short messages to set up the call and report its state. One of these, called MediaState, reports whether the microphone is muted, whether the camera is on and how the video is rotated. NebuSec says the code that reads these messages did not handle missing fields correctly and accessed memory it should not. A review by The Hacker News of Telegram's published code for version 12.10.3 found a matching flaw. The Hacker News has asked NebuSec and Telegram whether the flaw was used in real attacks, and what an attacker's code could reach on a phone. Those answers are not yet known.

The same correction appeared in the shared call library on April 21, 2026, and reached iOS and desktop source code earlier than Android. Whether the older code in those apps could be exploited has not been shown.