Telegram’s Android Call Issue: Facts, Context, And What To Do

🔍 Read the full analysis: Telegram’s Android Call Issue: Facts, Context, And What To Do on ThorstenMeyerAI.com

Age 18–24?Offer from Amazon

Prime made for students and young adults

• Fast, free delivery for dorm and study essentials
• Prime Video and Amazon Music included
• Member-only deals

Try Prime for Young Adults →Free trial for eligible 18–24 year olds

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a memory bug in Telegram for Android on October 29, saying it could form part of an attack chain that takes control of a phone after its owner answers a call. Telegram had already released a fix in version 12.10.4 in late September, according to NebuSec. The company says it has seen no real-world attacks, but has not published a technical report documenting the full chain.

NebuSec says the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, covering releases from March 2022 to September 2026. It described the issue as a memory bug in the app’s voice-call code. The company says the vulnerable call bug alone was not sufficient to take over a phone: it allegedly had to be combined with a second bug that leaked information and a third flaw that could provide Android root access, or administrator-level control.

According to NebuSec chief executive Eten Zou, an attacker needed an ordinary Telegram account and the victim had to answer a private voice call. The company said it confirmed the chain on ARM64 phones, a processor architecture used by most modern Android devices. Its short demonstration video shows a call connecting before the target phone returns to its home screen. The video does not identify the Telegram or Android versions used, and does not independently establish the full technical details.

The source account says Telegram acknowledged NebuSec’s report but did not agree that the bug could be used for remote code execution. No CVE identifier has been assigned, and the account reports that no bounty was paid. As of October 29, the US National Vulnerability Database listed no CVE for the flaw, and the CISA catalog of known exploited vulnerabilities had no Telegram entry. The source also found no public Telegram statement. Those absences do not establish whether the issue was exploited.

Why Answered Calls Matter

The alleged attack required a user to answer an incoming call, so it is described as one-click rather than zero-click. That distinction matters: the reported scenario does not involve a phone being compromised simply because a call arrived. It does, however, describe a familiar, ordinary action as the point at which an attack chain could begin.

If NebuSec’s account is accurate, the potential impact would go beyond a Telegram account: root access could expose information and functions across the phone, including messages, the microphone and the camera. Those consequences remain claims about the reported chain, not independently verified findings. For individual users, the confirmed practical step is straightforward: install the version containing the fix. For employers, the case also shows that vulnerability monitoring based only on CVE identifiers may not flag every reported app issue.

Products Worth Considering

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue

AmazonView Latest Price

LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates Disclosure

NebuSec says it reported the issue to Telegram on September 26, after version 12.10.4 had appeared. The source account independently compared Telegram’s public Android code in versions 12.10.3 and 12.10.4. It describes the earlier code as checking that a camera-rotation value existed, then reading a different video-state field that might be absent; the later code reads the rotation field. That code comparison supports the presence of a change, but does not by itself verify NebuSec’s full multi-flaw attack chain.

The same account found that Telegram’s shared call library, used across its apps, received a similar correction on April 21, 2026, in a change titled “Fix camera rotation.” It says the Android source with the fix appeared later, and reports that iOS and desktop versions received the change in subsequent months. NebuSec has not shown that those platforms, or group calls, were exploitable. The issue should therefore be treated as a reported Android vulnerability, not as evidence that every Telegram app or call type was affected.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

What the Evidence Does Not Show

The key unresolved issue is the full attack chain. NebuSec has not released a technical write-up of the two additional bugs, and the available demonstration does not show the software versions on the phones. The source account says it could verify a relevant change in Telegram’s Android code, but could not verify the other flaws, whether the chain works against a fully patched Android device, or whether anyone used it before disclosure.

NebuSec says it has seen no real attacks. That means the company reports no observed exploitation; it does not prove that exploitation never occurred. It is also not clear from the available material whether Telegram will publish a security advisory, whether a CVE will be assigned, or what testing Telegram conducted. Claims about iOS, desktop and group-call exposure remain unproven.

Update and Limit Incoming Calls

Android users should update Telegram and check the version shown at the bottom of Settings. The reported fix is in version 12.10.4 or later. Until updated, users can set “Who can call me?” to “My Contacts” or “Nobody,” as appropriate, and decline calls from unknown people. These steps reduce exposure to the reported call scenario; they do not substitute for installing the fix.

Organizations that use Telegram on work phones can set a minimum supported app version and review their messenger policies. Readers should watch for a Telegram advisory, a technical analysis from NebuSec, or updates to vulnerability databases. Those could clarify the exploit chain, affected platforms and whether the issue was used in attacks. Until such evidence appears, the reported Android bug and the existence of a code correction are better supported than claims about broader exposure or real-world compromise.

Key Questions

Which Telegram Android versions are reported as affected?

NebuSec says versions 8.6.2 through 12.10.3 were affected. It identifies 12.10.4 as the fixed version. Check Telegram’s Settings for your installed version and update the app.

Could someone hack my phone just by calling me?

NebuSec’s reported scenario required the user to answer a private voice call; the company described it as a one-click attack, not a zero-click attack. It has reported no observed real-world attacks, and the full technical chain has not been independently documented in the supplied material.

Does the report affect Telegram on iPhone or desktop?

The available account does not establish that iOS or desktop apps were exploitable. It says the shared call library received a similar correction, but direct exposure on those platforms has not been shown. NebuSec also has not shown that group calls were affected.

What should I do if I cannot update right away?

Set Telegram’s “Who can call me?” option to My Contacts or Nobody, and avoid answering calls from unknown people until you update. These are interim precautions; install version 12.10.4 or later when available.

Source: ThorstenMeyerAI.com