Telegram Android flaw fixed after voice-call exploit chain
A Telegram Android flaw could allow code to run after a user answered a private voice call, when combined with two additional vulnerabilities, according to security company NebuSec. Remote code execution means making a device run instructions supplied by an attacker. Telegram corrected the call-handling flaw in version 12.10.4, released in late September, and NebuSec disclosed its findings on October 29.
NebuSec said the vulnerable range extends from Telegram for Android 8.6.2 through 12.10.3, covering releases issued between March 2022 and September 2026. The company confirmed the behavior in private calls on ARM64 phones, which use a common processor architecture found in mobile devices. It has not found evidence that the flaw directly affects group calls or Telegram's iOS and desktop applications. The attack required only a normal Telegram account, but the intended victim still had to answer the call.
The flaw alone was one part of a larger chain. NebuSec said it paired the call vulnerability with an information leak, a bug that exposes data from memory, to break out of the Telegram app and reach Android. A further Android root exploit, which obtains the device's highest level of control, could then give an attacker access to the phone, including its messages, microphone and camera. NebuSec said it has not observed the chain being used in real attacks and believes others had not recognized the call flaw as a route to remote code execution.
Users should update Telegram for Android to version 12.10.4 or later. The installed version is shown at the bottom of the app's Settings page. People who cannot update can prevent this specific call route by changing Telegram's call privacy setting to "Nobody" or by declining incoming calls. The Telegram Android flaw did not have a CVE identifier as of October 29.
NebuSec reported the issue to Telegram on September 26, after version 12.10.4 had already shipped. According to NebuSec, Telegram acknowledged the report but did not agree that the flaw could be developed into remote code execution. NebuSec said no bug bounty was paid and no CVE was assigned. The Hacker News said it had requested comment from Telegram.
The underlying error involved MediaState messages exchanged while Telegram establishes a call and communicates changes in its status. These messages can describe whether the microphone is muted, whether the camera is active and how video is rotated. NebuSec said the receiving code did not safely handle a message with a missing field, causing it to access memory that it should not read.
The Hacker News reviewed Telegram's published source code for version 12.10.3 and found code matching that account. When a MediaState message supplied a rotation value, the old code checked that value but subsequently read the video-state field, even when that separate field was absent. Version 12.10.4 reads the rotation value from the correct field. The calling code involved in processing the message was enabled in version 8.6.2, which is the first affected release identified by NebuSec.
Telegram's Android, iOS and desktop applications share a calling library named tgcalls. A change labeled as a camera-rotation correction was added to that library on April 21, 2026. The iOS source included it from version 12.7 in May, while the desktop source incorporated it in version 7.0.1 in July. Android did not receive the correction until version 12.10.4 in September. It has not been demonstrated that the earlier code was exploitable on iOS or desktop.
Public evidence for the full chain remains limited. NebuSec released a demonstration showing an attacker phone and a victim phone. After the victim accepts a call, the second device returns to its home screen roughly half a minute later, its app icons move down the display and a takeover message appears. The recording does not identify the Telegram or Android versions in use. NebuSec had not published a technical analysis by October 29, so details of the two additional vulnerabilities and the complete chain currently depend on the demonstration and the company's statements.
NebuSec, which is backed by Y Combinator, says its Code Security product running on OpenAI's GPT-5.4 model found the flaw. In July, the company also described an Android exploit chain that began with a Firefox vulnerability and reached the kernel, the central part of the operating system, on an ARM64 device running Android 17.
A separate Telegram-related memory-safety issue affects rlottie, a library used by Telegram applications to display animated stickers. The Zero Day Initiative published an advisory on October 15 for CVE-2026-111105, an unpatched flaw with a Common Vulnerability Scoring System severity score of 7.0. ZDI said an attacker could execute code if a user opened a malicious file or page. Telegram told ZDI in March that checks on its servers mitigated the problem and asked for a complete remote-code-execution chain in April.
An abstract for research presented at OffensiveCon in Tokyo says those server checks could be bypassed. The work used AI-guided fuzzing, which repeatedly gives software malformed or unexpected data, to identify memory-corruption flaws in rlottie across Telegram's Android, iOS and desktop applications. The research then combined those flaws with weaknesses in sticker delivery and checking to run code on Telegram for iOS.
Telegram's published source code shows that Android replaced rlottie with a Rust-based library named tlottie between versions 12.8.1 in June and 12.10.0 in August. The desktop source made the same change in September. The iOS source added tlottie in version 13.0 in October but continued to include rlottie. For organisations reviewing mobile-app risk alongside their wider environment, AEU-I offers security-first IT, infrastructure and consulting.
For users and IT teams, the immediate action is to verify that every Android installation is on version 12.10.4 or newer. The lack of observed exploitation lowers the available evidence of active risk, but it does not replace installing the corrected release or restricting calls on devices that cannot yet be updated.