Picking up a Telegram call on Android could have given an attacker a foothold on your phone. Security startup NebuSec found a memory bug in the app's calling code, chained it with two more bugs, and showed full device takeover in a demo video. Telegram already shipped the fix, so the only job left for users is to confirm they run a patched build.
Which Telegram for Android Versions Are Vulnerable?
The bug lives in every Telegram for Android release from 8.6.2 up to 12.10.3.
Those builds span roughly four and a half years, from March 2022 through September of this year. Telegram switched on the vulnerable calling code in 8.6.2, and version 12.10.4, released in late September, closed the hole. NebuSec went public with its findings on October 29.
| Detail | Status |
|---|---|
| Affected builds | 8.6.2 to 12.10.3 |
| Fixed build | 12.10.4 and later |
| Platform confirmed | Android on ARM64 phones |
| Call type tested | Private one-to-one voice calls |
| CVE ID | None assigned at disclosure |
| Known real-world attacks | None reported |
NebuSec has no evidence that the bug directly hits Telegram on iOS, the desktop app, or group calls.
How to Fix It: Update Telegram and Block Unknown Callers
Updating Telegram for Android to 12.10.4 or newer removes the risk entirely.
- Open Telegram and go to Settings.
- Scroll to the very bottom of the page and read the version number.
- If it shows anything from 8.6.2 to 12.10.3, update the app from Google Play or your usual app source.
If you cannot update right away, block the attack path instead. The exploit only fires on an answered call, so either of these steps stops it:
- Go to Settings > Privacy and Security > Calls and set Who can call me to Nobody.
- Decline Telegram calls from accounts you do not know.
IT teams managing Android fleets can check installed builds from a terminal with this command:
adb shell dumpsys package org.telegram.messenger | grep versionNameFlag any device that reports a version inside the affected range and push the update through your mobile device management tool.
Can Hackers Take Over Your Phone Through a Telegram Call?
Yes, if the victim answers, and the attacker needs nothing more than a regular Telegram account.
There is no malicious link to click and no file to open. The attacker rings the target, the target answers, and the exploit runs during the live call. Because the victim has to pick up, this does not count as a zero-click attack, but answering a call is about as routine as phone use gets, and nothing on screen warns the user.
In NebuSec's demo, the victim's phone accepts the call, and about 30 seconds later it jumps to the home screen, the app icons tumble off the display, and a "HACKED BY NEBUSEC" banner takes over. The video does not reveal which Android or Telegram build the test phone ran.
How the Telegram MediaState Bug Works
The flaw sits in the parser that reads MediaState messages inside Telegram's calling library.
When two Telegram users talk, their apps keep swapping small signaling messages that set up the call and report its status. MediaState is one of them. It tells the other side whether your microphone is muted, whether your camera is on, and how your video should be rotated.
Telegram's calling code checked that a MediaState message carried a rotation value, then went on to read a separate field, the video state, without first confirming that field existed. A crafted message that included rotation but left out video state pushed the code into reading memory it had no business touching. In native C++ code, that kind of mistake does not throw a clean error. It produces undefined behavior that a skilled attacker can bend toward code execution.
The fix in 12.10.4 simply pulls the rotation value from the correct field, so the parser never reaches for missing data.
How Attackers Chain Three Bugs to Control an Android Phone
The MediaState flaw alone does not take over a phone, so NebuSec stacked it with two other bugs.
According to NebuSec's CEO Eten Zou, the chain works in three stages:
- The MediaState bug corrupts memory inside the Telegram app during the call.
- An information-leak bug pairs with it to break out of the Telegram app and reach Android itself.
- An Android root exploit finishes the job, giving the attacker the phone's messages, microphone, and camera.
NebuSec has not posted a technical write-up, so outside researchers cannot yet verify the full chain. The parsing defect itself does show up in Telegram's public source code for 12.10.3, and the fix shows up in 12.10.4.
Why Telegram for Android Got the Fix Months After iOS and Desktop
Telegram fixed the same code for iOS and desktop long before Android users saw it.
All three apps share one calling library called tgcalls. A change labeled "Fix camera rotation" corrected the faulty logic in that library in April. The iOS app pulled it in with version 12.7 in May, and the desktop app with version 7.0.1 in July. Android only received it with 12.10.4 in September, which left Android users on the vulnerable code for about five months after the shared library already had the fix. No one has shown whether the older code was exploitable on iOS or desktop.
NebuSec reported the bug to Telegram on September 26, after 12.10.4 had already shipped. Telegram acknowledged the report but did not believe the flaw could lead to remote code execution, so it assigned no CVE and paid no bug bounty, according to Zou.
Telegram rlottie Sticker Flaw and the Move to Rust
Telegram also faces an unrelated bug in rlottie, the library its apps used to render animated stickers.
The Zero Day Initiative published an advisory on October 15 for CVE-2026-111105, rated 7.0 on the CVSS scale. The flaw can let an attacker run code when a user opens a malicious file or page. Telegram told ZDI in March that server-side checks blocked it, but researcher Saifeldeen Aziz says he bypassed those checks and chained rlottie memory bugs with sticker delivery flaws to run code on Telegram for iOS. He used AI-guided fuzzing to find the bugs and plans to present the work at OffensiveCon in Tokyo.
Telegram has been swapping rlottie out for tlottie, a replacement written in the memory-safe Rust language:
- Android: switched between version 12.8.1 in June and 12.10.0 in August
- Desktop: switched in September
- iOS: added tlottie in version 13.0 in October, while still shipping rlottie
How NebuSec Found the Bug With GPT-5.4
NebuSec, a Y Combinator-backed startup, says its Code Security product spotted the MediaState flaw using OpenAI's GPT-5.4 model.
AI code scanners are good at catching patterns like this one, where code checks one field and then trusts a different one. Turning that flag into a working exploit on a hardened ARM64 phone still took human exploit work. NebuSec has used the same approach before: in July, it described an Android exploit chain that started from a Firefox bug and reached the kernel of an ARM64 device on Android 17.
Frequently Asked Questions
Is my Telegram app still vulnerable?
Only if it runs a version between 8.6.2 and 12.10.3. Check the number at the bottom of the Settings page, and update if it falls in that range.
Does this flaw affect Telegram on iPhone or desktop?
NebuSec has no evidence that it does. Both apps received the corrected calling code months before Android, in iOS 12.7 and desktop 7.0.1.
Has anyone used this bug in real attacks?
NebuSec has not seen it exploited in the wild and believes no one else realized the bug could lead to code execution.
Can I stay safe without updating?
Yes, for this specific bug. Set Telegram's call privacy to Nobody or decline calls from unknown accounts, since the attack only works when you answer. Updating remains the better fix.
Does group calling carry the same risk?
NebuSec tested only private one-to-one voice calls and has no evidence the flaw affects group calls.
Related Guides
- Signal CVE-2026-113380: Bug Could Keep Your Call Audio Live After You Hang Up
- OpenClaw Patch Fixes One-Click RCE Bug Exploited Through Malicious Links
- Google Patches Chrome Zero-Day Vulnerability CVE-2026-2441 Exploited in Active Attacks
- Microsoft Issues Emergency Patch for Actively Exploited Office Zero-Day (CVE-2026-21509)
- CVE-2026-46333: How to Fix the Linux Kernel Privilege Escalation Vulnerability
