When A Telegram Call Becomes A Potential Attack

🔍 Read the full analysis: When A Telegram Call Becomes A Potential Attack on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get hardware and tech essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android voice-call code on October 29, saying an attacker could use it as the entry point to take control of a phone after a person answered a call. Telegram Android version 12.10.4, released in late September, includes a correction to the call code, according to the company and a review of Telegram’s public source code described in the source report. NebuSec says it has seen no real-world attacks; the complete exploit chain has not been publicly documented.

NebuSec chief executive Eten Zou told The Hacker News that the call bug alone was not sufficient to control a device. He said attackers could combine it with a second flaw that leaks information and a third Android root exploit, which would grant administrator-level access. The company says that chain could expose messages and provide access to the phone’s microphone and camera. According to Zou, an attacker would need an ordinary Telegram account, and the victim would have to answer the call: this is a one-click attack claim, not a zero-click one.

NebuSec said it confirmed the attack in private voice calls on ARM64 Android phones. Its October 29 post included a short demo showing a call connecting before the victim phone returned to its home screen. The video does not identify the Telegram or Android versions used. The source report says NebuSec had not published a technical write-up of the flaw or the other two bugs as of October 29, leaving the full chain dependent on the company’s account and demonstration.

The source report’s author says a comparison of Telegram’s public Android code for versions 12.10.3 and 12.10.4 found the relevant call-code correction. In the earlier version, the program checked one field in a call-status message but read a different field that might be absent; the later code reads the field it checked. NebuSec’s reported affected range is Android versions 8.6.2 through 12.10.3. The report found no evidence that group calls, iOS or desktop apps were directly affected, although related code is shared across platforms.

Why Call Handling Raises Risk

Voice calls require an app to process connection data from another account before the recipient has much opportunity to evaluate the caller. That makes errors in call-handling code a potential security concern: answering a call can expose the app to incoming data, even when the person has no reason to trust the caller. Google’s Project Zero wrote in 2018 that picking up a call is “a reasonable action to expect a user to take.”

The reported flaw also highlights a practical gap for organisations. The source report says there is no CVE number for the issue as of October 29 and no listing in the US Cybersecurity and Infrastructure Security Agency’s known exploited vulnerabilities catalog dated October 28. Companies whose security tools rely on CVE tracking may not see this issue there. Updating apps and setting minimum versions on work phones can reduce exposure, while the lack of public technical detail makes independent risk assessment harder.

Products Worth Considering

Trezor Safe 7 Crypto Hardware Wallet

AmazonView Latest Price

Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo

AmazonView Latest Price

Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

How the Android Fix Emerged

NebuSec said it reported the issue to Telegram on September 26, shortly after version 12.10.4 had appeared. Zou told The Hacker News that Telegram acknowledged the report but did not believe the bug could be used for remote code execution; he said no bounty was paid. The source material reports no public response from Telegram as of October 29, so the company’s assessment and its reasoning have not been independently explained there.

The source report also found that Telegram’s shared call library, tgcalls, received a similar correction on April 21, 2026, in a change labelled “Fix camera rotation.” The Android source containing the correction appeared later, according to the report. It cited The Hacker News for the account that iOS incorporated the change in May and desktop in July. A shared fix does not, by itself, establish that those versions were vulnerable or exploitable.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

Limits of the Public Evidence

The reported vulnerability and the proposed attack chain have not been fully detailed in a public technical analysis from NebuSec in the source material. The short demo does not show the software versions used, and the source report says its author could not verify the second information-leak bug or the Android root exploit. It also could not establish whether the full chain works against a current, fully patched Android device.

NebuSec says it has seen no real attacks, but that does not establish that the flaw was never used. The source material reports no CVE assignment and no CISA exploited-vulnerability listing as of the stated dates. It remains unclear whether Telegram will publish its own explanation, whether any platform beyond the reported Android versions was at risk, and whether researchers or authorities have evidence beyond NebuSec’s disclosure.

Update Telegram and Watch for Details

Android users should check the Telegram version shown in the app’s Settings and update to 12.10.4 or later, the version identified in the source material as containing the correction. Until updated, the report advises setting “Who can call me?” to My Contacts or Nobody and declining calls from unfamiliar accounts. These steps reduce exposure to the reported call path; they do not establish that every device or related vulnerability is covered.

Organisations can set a minimum Telegram version for work phones and review messenger policies rather than relying only on CVE feeds. Further clarity depends on whether Telegram or NebuSec releases technical details, including the other claimed bugs and the tested device and software versions. As of October 29, the disclosed fix is the clearest confirmed practical development, while the scope and real-world use of the full attack chain remain unconfirmed.

Key Questions

What did NebuSec report?

NebuSec reported a flaw in Telegram’s Android voice-call code. Its chief executive said the issue could be combined with two other bugs to gain control of a phone after the recipient answered a call. Public technical details for the complete chain were not available in the source material.

Which Telegram version contains the reported fix?

The source material identifies Telegram for Android 12.10.4 as containing the correction. Users can check the version listed in Settings and update if their app is older.

Were attacks reported in the wild?

NebuSec said it had seen no real attacks. That is the company’s report, not proof that the flaw was never exploited; the source material does not establish whether anyone used it before disclosure.

Does the report say iPhones or desktop apps were affected?

No direct effect on iOS, desktop or group calls was established in the source material. Related call code is shared across platforms, but that alone does not show those versions were vulnerable or exploitable.

What should Telegram users do now?

Update Telegram for Android to version 12.10.4 or later. If unable to update immediately, the source report recommends limiting who can call the account to contacts or nobody and declining calls from unfamiliar users.

Source: ThorstenMeyerAI.com