What To Know Before Responding To A Telegram Call On Android

🔍 Read the full analysis: What To Know Before Responding To A Telegram Call On Android on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on office and shipping supplies

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram for Android on October 29, saying an attacker could use it as part of a chain of vulnerabilities to take control of a phone after its owner answered a call. Telegram’s version 12.10.4, released in September, includes a correction to the call-handling code, according to NebuSec. The company says it has seen no real-world attacks, but the full attack chain has not been independently detailed in a public technical report.

NebuSec said the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, covering releases from March 2022 to September 2026. The company described the call bug as one part of a three-bug chain: it said a second flaw could expose information and help an attacker escape the Telegram app, while a third Android exploit could provide administrator-level access. NebuSec told The Hacker News that an attacker needed an ordinary Telegram account and that the chain worked in private voice calls on ARM64 phones.

The reported method requires the target to answer the call. That makes it a one-click attack, not a zero-click attack, according to the description. NebuSec posted a short demonstration video, but it does not identify the Telegram or Android versions used on the victim phone. As of October 29, the startup had not published a technical write-up of the full chain. NebuSec’s claims about the additional bugs and resulting access therefore remain based on its account and demonstration.

A review of Telegram’s public Android source code by the source article found a change between versions 12.10.3 and 12.10.4 in how call-status data is read. In the earlier code, it checked that a camera-rotation value existed but then read a different field; the later code reads the rotation field. The source article says the relevant correction had appeared earlier in Telegram’s shared call library. NebuSec said it reported the issue on September 26, after version 12.10.4 had appeared, and that Telegram acknowledged the report but did not agree the issue could be used for remote code execution. The article found no public reply from Telegram.

Why Answering a Call Matters

The report highlights a security risk in a feature people may treat as routine: answering a voice call from an unfamiliar account. Call software must process information from another user as a connection is established, so errors in that code can create an opening before the recipient has shared a message or file. NebuSec’s account says a successful attack would have required more than the call flaw alone, but the company alleges the combined chain could expose messages and permit access to the microphone and camera.

For individual users, the immediate practical step is to update Telegram for Android to version 12.10.4 or later and be cautious about calls from unknown people until updated. For organizations, the absence of a CVE number may complicate vulnerability tracking: systems that rely only on CVE feeds may not flag this report. That does not establish that a company device was exposed or attacked; it means administrators may need to check app versions directly and apply their own messaging-app policies.

Popular right now

De'Longhi Magnifica Evo Fully Automatic Espresso Machine with Manual Milk Frother, Silver

AmazonView Latest Price

Vitamix Propel Series 750 Professional-Grade Blender, 4 Programs, Black

AmazonView Latest Price

KitchenAid Artisan Series 5-Quart Tilt-Head Stand Mixer, Dried Rose (KSM150PS)

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates the Disclosure

NebuSec announced the issue on October 29, after Telegram had released Android version 12.10.4 in September. The source article’s review of Telegram’s public code found a related correction in the shared tgcalls library on April 21, 2026, under a change titled “Fix camera rotation.” It says the Android source containing the correction appeared later, while The Hacker News reported that iOS and desktop apps incorporated the change in May and July, respectively.

That shared code is relevant, but the available material does not establish that other platforms were exploitable. NebuSec had no evidence that iOS, desktop apps or group calls were directly affected. The source article also reported that, as of October 29, the flaw had no CVE number and was absent from the U.S. government’s known-exploited-vulnerabilities catalog. Those absences do not prove the flaw was never exploited; they describe the public records checked at that time.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

What the Public Evidence Shows

The full exploit chain has not been laid out in a public technical report, and the demonstration video does not show the software versions involved. The source article says it could compare Telegram’s Android call code but could not verify the two additional bugs, whether the chain works against a current, fully patched Android phone, or whether anyone used the flaw before disclosure. NebuSec says it has seen no real attacks; that is not proof that none occurred.

Telegram’s response also remains incomplete in the available material. Zou said the company acknowledged the report but did not believe the bug could lead to remote code execution. The source article found no public statement from Telegram, and there is no CVE assignment or public explanation resolving the disagreement. It is also not established whether the related code in iOS or desktop apps was exploitable before their reported updates.

Update and Check Call Settings

Android users should install the latest Telegram version available to them and check the version number near the bottom of the app’s Settings page; the reported fix is version 12.10.4 or later. Until updated, NebuSec’s report recommends limiting “Who can call me?” to My Contacts or Nobody and declining calls from unfamiliar accounts. These steps reduce exposure to the reported call path but do not replace keeping the phone and apps current.

Organizations using Telegram on work devices can verify installed app versions and set a minimum supported version through their device-management practices. Further confirmation would depend on Telegram or NebuSec publishing more technical details, including the other alleged bugs and platform scope. Until then, users should treat the claimed impact as a security report that warrants an update, not as evidence that their phone was compromised.

Key Questions

What is the Telegram Android flaw?

NebuSec says a bug in Telegram’s Android call-handling code could form part of an attack chain. The company alleges that, with two other bugs, answering a call could lead to control of the phone.

Which Telegram version fixes the reported issue?

NebuSec identifies Telegram for Android 12.10.4 as the fixed version. Users should install that version or a later release and confirm the app is up to date.

Could the attack happen without answering a call?

The reported attack requires the user to answer, so the source describes it as one-click rather than zero-click. The full chain has not been independently documented in a public technical report.

Were Telegram users known to have been attacked?

NebuSec says it has seen no real-world attacks. That statement does not establish that the flaw was never used; the source material says prior exploitation could not be checked.

Does the report affect Telegram on iPhone or desktop?

The available material does not show that those apps were exploitable. NebuSec had no evidence that iOS or desktop versions, or group calls, were directly affected, although the call library is shared across platforms.

Source: ThorstenMeyerAI.com