A security vulnerability in Telegram for Android could allow attackers to take complete control of a victim’s smartphone through a voice call, provided the victim answers it.
Cybersecurity startup NebuSec disclosed the issue on October 29, warning that the flaw could be chained with two additional vulnerabilities to achieve remote code execution and potentially compromise an entire Android device.
According to NebuSec, an attacker only needs a regular Telegram account to initiate the attack. The vulnerability was fixed in Telegram version 12.10.4, released in September 2026. Users running older versions between 8.6.2 and 12.10.3 may be affected.
NebuSec co-founder and CEO Eten Zou told The Hacker News that the vulnerability can be combined with an information-disclosure flaw to escape Telegram’s application environment and gain access to Android. Chaining the exploit with an additional Android root vulnerability could then give attackers extensive control over the compromised device, including access to private messages, the microphone and the camera.
The vulnerability affects Telegram’s Android voice-calling functionality and is related to how the application processes signaling messages exchanged between callers. During a voice call, Telegram sends short messages containing information about the call’s status, including whether the microphone is muted, whether the camera is enabled and the video’s rotation settings.
NebuSec discovered a memory-handling issue in the code responsible for processing these messages. Specifically, the application could incorrectly access memory when certain fields were missing from a MediaState message, potentially creating an opportunity for exploitation.
A review of Telegram’s publicly available source code by The Hacker News found code in version 12.10.3 that matched the reported vulnerability. The updated version 12.10.4 corrected the issue by reading the rotation value from the appropriate field.
NebuSec said it successfully tested the exploit during private voice calls on ARM64-based Android devices. However, the company has not found evidence that the vulnerability has been used in real-world attacks. It also has not demonstrated that the same attack directly affects Telegram’s iOS or desktop applications or group calls.
The attack requires victims to answer an incoming Telegram voice call. NebuSec said users can prevent this particular attack by declining unexpected calls or changing Telegram’s call privacy settings to Nobody, which prevents other users from calling them.
The company reported the vulnerability to Telegram on September 26, after version 12.10.4 had already been released. According to Zou, Telegram acknowledged the report but questioned whether the issue could be used to achieve remote code execution. As of October 29, the vulnerability had not received a CVE identifier, and NebuSec said it had not received a bug bounty payment.
NebuSec demonstrated the attack in a video showing an attacker initiating a Telegram call and a victim accepting it. Approximately 30 seconds later, the victim’s device appeared to leave the Telegram application before displaying a hacking message. However, the demonstration did not identify the exact Telegram or Android version used, and the company had not published a complete technical breakdown of the exploit chain at the time of disclosure.
Separately, Telegram is facing scrutiny over another security issue involving its animated sticker functionality. The Zero Day Initiative published an advisory on October 15 describing an unpatched vulnerability in rlottie, a library previously used by Telegram applications to render animated stickers.
Tracked as CVE-2026-111105 with a CVSS score of 7.0, the vulnerability could allow attackers to execute code when users open specially crafted malicious files or pages, according to ZDI.
Security researcher Saifeldeen Aziz demonstrated research involving AI-guided fuzzing to identify memory-corruption vulnerabilities in rlottie across Telegram’s Android, iOS and desktop applications. The research also explored how these weaknesses could be combined with problems in sticker delivery and validation to achieve code execution on Telegram for iOS.
Telegram has since moved away from rlottie in several of its applications, replacing it with tlottie, a Rust-based library. The Android application made the transition between versions 12.8.1 and 12.10.0, while the desktop application followed in September. The iOS application added tlottie in version 13.0 in October, although its source code still included rlottie.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Android users should check their installed Telegram version and update to version 12.10.4 or later to address the voice-call vulnerability. The version number can be found at the bottom of Telegram’s Settings page. Users should also avoid answering unexpected calls and review their call privacy settings to reduce exposure to suspicious contact attempts.
