Could Answering A Telegram Call Put Android Users At Risk?

🔍 Read the full analysis: Could Answering A Telegram Call Put Android Users At Risk? on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram for Android that it says could let an attacker take control of a phone after a user answered a call, using the bug together with two other vulnerabilities. Telegram fixed the call-code bug in version 12.10.4, released in September, but NebuSec’s description of the full exploit chain has not been supported by a public technical report, and the company says it has seen no real-world attacks.

NebuSec said the affected range was Telegram for Android versions 8.6.2 through 12.10.3, dating from March 2022 to September 2026. The company said an attacker needed an ordinary Telegram account and that the victim had to answer the incoming call. That makes the described scenario a one-click attack, not a zero-click attack: user action is required.

According to NebuSec chief executive Eten Zou, the call-handling bug was only one part of the chain. A second flaw allegedly exposed information and helped the attacker escape Telegram’s app environment; a third Android exploit allegedly provided root access, or administrator-level control. NebuSec said it tested the chain in private voice calls on ARM64 Android phones. The company has not published a detailed technical write-up of the other two flaws, and the brief demonstration it shared does not identify the software versions shown.

The source code for Telegram’s Android app is public. A comparison of versions 12.10.3 and 12.10.4 found a change in how call status messages handle a video-rotation value: the earlier code checked that one field existed, then read a different field that might be absent; the later code reads the rotation field. That comparison supports the existence of a code change, but does not by itself establish that the flaw enabled the full attack NebuSec describes.

Why Answering Calls Matters

Telegram calls are designed to receive setup data from another account so a call can connect. That makes call handling a potential point of exposure: the app must process incoming information before a recipient has much reason to trust the caller. In this case, NebuSec says answering a call from an unknown account could trigger the first bug in a larger chain.

The practical step is straightforward: update Telegram for Android to version 12.10.4 or later and check the installed version in Settings. Until updated, users can reduce exposure by limiting who may call them to contacts or nobody, and by declining unexpected calls. The report does not establish that merely receiving a call is enough to trigger the described attack.

The disclosure also has implications for organizations. Security tools that track only CVE identifiers may not flag a flaw with no assigned CVE. Companies that use Telegram on work phones may need to set minimum app versions and maintain a policy for messaging apps, rather than relying solely on vulnerability feeds.

Products Worth Considering

Logitech MX Brio Ultra HD 4K Webcam, Graphite

AmazonView Latest Price

LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor

AmazonView Latest Price

LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The September Fix and Disclosure

NebuSec said it reported the issue to Telegram on September 26, after version 12.10.4 had already been released. Zou told The Hacker News that Telegram acknowledged the report but did not believe the bug could be used for remote code execution. According to Zou, no CVE was assigned and no bounty was paid. These details come from the company’s account; Telegram had not made a public statement in the source material.

The shared call library used across Telegram apps received a similar code correction in April 2026 under a change titled “Fix camera rotation.” The source material says the iOS app incorporated the change in May and desktop in July, but it has not been shown that those apps were exploitable. NebuSec said it had no evidence that iOS, desktop or group calls were directly affected.

As of October 29, the US National Vulnerability Database had no CVE entry for the reported flaw, and the US Cybersecurity and Infrastructure Security Agency’s known exploited vulnerabilities catalog had no Telegram entry. Those absences do not establish whether an exploit occurred; they indicate that the flaw was not listed in those public records at that time.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

Evidence Behind the Exploit Chain

The main uncertainty is the gap between the code defect visible in Telegram’s public source and NebuSec’s claim that it could be combined with two other bugs to gain full control of an Android phone. NebuSec has not published a technical report detailing those additional flaws, and the demonstration described in the source does not show the Telegram or Android versions involved. The full chain therefore rests largely on the company’s statements and its short video.

It is also not clear whether the chain works on a current, fully patched Android device, whether any attacker used the flaw before the disclosure, or whether the shared call code presented a similar risk on iOS or desktop. NebuSec said it had seen no real attacks, but no observed attacks are not proof that none occurred. The absence of a CVE and of a CISA listing does not resolve those questions.

Update Devices and Watch for Details

Android users should check that Telegram is on version 12.10.4 or later and install an update if it is not. Users who cannot update immediately can restrict incoming calls in Telegram’s privacy settings and avoid answering unexpected calls. These steps address the reported risk while the technical account remains incomplete.

Further confirmation would depend on a detailed public analysis from NebuSec, a statement from Telegram, or independent research validating the exploit chain and clarifying which Android configurations are affected. Organizations should check app versions on managed devices and consider whether their update and vulnerability-monitoring processes account for reported issues without CVE identifiers.

Key Questions

Can simply receiving a Telegram call hack an Android phone?

NebuSec’s described attack required the victim to answer the call. The company characterized it as one-click, not zero-click. The available information does not show that receiving or ignoring a call alone triggers the chain.

Which Telegram versions were reported as affected?

NebuSec identified Telegram for Android versions 8.6.2 through 12.10.3 as affected and said the call-code bug was fixed in version 12.10.4. The report does not establish that every device in that range could be compromised through the full chain.

What should Android users do?

Update Telegram to version 12.10.4 or later. Until then, consider limiting who can call you to contacts or nobody and declining unexpected calls.

Has Telegram confirmed the reported attack?

The source material reports no public statement from Telegram. NebuSec said Telegram acknowledged its report but did not agree that the flaw could be turned into remote code execution. The full exploit chain has not been independently established in a public technical report.

Were iPhones or Telegram desktop users affected?

NebuSec said it had no evidence that iOS, desktop or group calls were directly affected. Similar call-code changes appeared in other Telegram clients, but the source material does not show that those versions were exploitable.

Source: ThorstenMeyerAI.com