When Answering the Call Is the Attack: What We Know About Telegram’s Android Flaw, and What to Do Now

By Thorsten Meyer | October 29, 2026 | ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

An incoming Telegram call. A name you don’t recognize. You tap the green button, mostly out of curiosity. According to the security startup NebuSec, on an Android phone with an outdated Telegram app, that one tap could have been the whole attack. NebuSec disclosed the flaw on October 29. Telegram had already fixed it in late September, in version 12.10.4.

The good news first: there is a fix, NebuSec says it has seen no real attacks, and you can block this kind of attack with one setting. The less comfortable news: the bug sat in Telegram’s call code for about four and a half years, it has no CVE number, and much of the story still rests on one company’s word. Here is what is confirmed, what is only claimed, and why the code behind a phone call keeps turning up in attack chains.

Key takeaways

• What: a memory bug in the code Telegram for Android uses for voice calls. NebuSec says that, chained with two more bugs, it gave an attacker full control of the phone, once the victim answered. That makes it “one-click”, not “zero-click”.
• Who: Telegram for Android versions 8.6.2 through 12.10.3 (March 2022 to September 2026), according to NebuSec. Fixed in 12.10.4. NebuSec has no evidence that the iOS or desktop apps, or group calls, are directly affected.
• Status: no CVE, no entry in the US government’s list of exploited bugs, no technical write-up, no attacks seen by NebuSec. I found no public statement from Telegram.
• For you: update Telegram and check that the version at the bottom of Settings reads 12.10.4 or later. Until then, set “Who can call me?” to My Contacts or Nobody, and decline calls from strangers.
• For companies: a fix without a CVE is invisible to tools that only track CVEs. Enforce minimum app versions on work phones and set a messenger policy.

Products Worth Considering

DJI Osmo Pocket 3 Vlogging Camera with 1-Inch CMOS Sensor and 4K Video

AmazonView Latest Price

Jackery HomePower 3000 Portable Power Station with Two 200W Solar Panels

AmazonView Latest Price

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

What happened

NebuSec, a startup backed by Y Combinator, announced the flaw on X on October 29 (UTC) with a short demo video: “Now picking up a wrong call can get you hacked,” the post says, adding that the bug was “fixed in Telegram Android 12.10.4 (7099)”. The details come from NebuSec’s chief executive Eten Zou, speaking to The Hacker News.

According to Zou, the call bug alone was not enough. Combined with a second bug that leaks information, it let an attacker break out of the Telegram app into Android. A third bug, an Android “root” exploit (root means full administrator rights over the phone), then gave full control, including messages, microphone and camera. The attacker needed only an ordinary Telegram account. NebuSec confirmed the attack in private voice calls on ARM64 phones, the chip design almost all modern Android phones use.

I watched the 22-second demo. Two phones side by side, labelled attacker and victim. The victim’s call connects, and seconds later the victim’s phone drops to its home screen, the app icons tumble down and a “HACKED BY NEBUSEC” logo appears. The video does not show which Telegram or Android version the victim ran. And as of October 29, NebuSec’s research page had no write-up of this flaw. So the full chain, including the two other bugs, rests on the video and on what the company says.

NebuSec reported the flaw to Telegram on September 26, just after the fixed version had appeared. Telegram acknowledged the report, Zou said, but did not believe the bug could be turned into remote code execution (running the attacker’s own code on your phone). So no CVE was assigned and no bounty was paid. The Hacker News asked Telegram for comment; I found no public reply.

What I could check myself

Telegram publishes the source code of its Android app on GitHub. I compared the call code of version 12.10.3 (published September 17) with 12.10.4 (published September 24).

The bug matches what NebuSec and The Hacker News describe. During a call, the two apps exchange short status messages. One type, called MediaState, reports whether your microphone is muted, whether your camera is on and how the video is rotated. In 12.10.3, the code checked that a rotation value was present, then read a different field, the video state, which a message does not have to contain. In 12.10.4, it reads the rotation field. Think of a clerk who checks that box 7 on a form is filled in, then copies whatever is in box 8, even when box 8 is blank.

Two more things I found in Telegram’s public code:

• The fix was older than the report. Telegram’s shared call library, tgcalls, which its Android, iOS and desktop apps use, received the same correction on April 21, 2026, in a change titled “Fix camera rotation”. The Android source with the fix appeared 156 days later (my arithmetic). In my reading, Telegram treated it as a camera bug, not a security hole. According to The Hacker News, the iOS app picked up the change in May and the desktop app in July. Whether the old code could be exploited there has not been shown.
• No CVE, no exploitation listing. The US National Vulnerability Database lists no CVE for this flaw as of October 29, and the CISA catalog of known exploited vulnerabilities (version of October 28) contains no Telegram entry at all.

What I could not check: the two other bugs, whether the chain works on a current, fully patched Android, and whether anyone used the flaw before NebuSec. “Not seen” is not the same as “never happened”.

Thorsten Meyer AI

Case file

Infographic 01 · Telegram for Android

One tap on “answer”, three bugs, one fix.

What is confirmed, what rests on NebuSec’s word, and what nobody knows yet about the voice-call flaw fixed in Telegram for Android 12.10.4.

12.10.4Telegram for Android version with the fix (source published 24 Sep 2026)

~4.5 yrsvulnerable range per NebuSec: 8.6.2 (March 2022) to 12.10.3 (September 2026)

1 tapthe victim has to answer the call. Declining, or calls set to “Nobody”, blocks it

0CVE numbers assigned. No entry in CISA’s list of exploited bugs either

1. The callAn ordinary Telegram account calls the victim
2. The tapThe victim answers. Without this, no attack
3. Bug 1Call code misreads a status message (MediaState)
4. Bug 2An information leak helps break out of the app
5. Bug 3An Android root exploit: messages, mic, camera

Chain as described by NebuSec’s CEO to The Hacker News. Bugs 2 and 3 are not public; no technical write-up exists yet.

Checked myself

• The bug and the fix match in Telegram’s public source (12.10.3 vs 12.10.4)
• Same correction in the shared call library on 21 Apr 2026, titled “Fix camera rotation”
• No CVE in the US vulnerability database (29 Oct)
• No Telegram entry in CISA’s exploited-bugs catalog (28 Oct)

NebuSec says

• Three chained bugs give full control of the phone
• Versions 8.6.2 to 12.10.3 are affected
• Its GPT-5.4-based product found the bug
• No real attacks seen; Telegram did not see code execution, paid no bounty

Not known

• What bugs 2 and 3 are
• Whether the chain works on fully patched Android
• Whether the old iOS and desktop code was exploitable
• Telegram’s own statement

• Mar 2022Version 8.6.2First version NebuSec names as affected
• 21 Apr 2026Shared call library fixedtgcalls change “Fix camera rotation”. iOS picks it up in May, desktop in July (per The Hacker News)
• 24 Sep 2026Android 12.10.4 source published156 days after the library fix (my arithmetic)
• 26 Sep 2026NebuSec reports to TelegramTelegram acknowledges, does not consider it code execution (per NebuSec)
• 29 Oct 2026Public disclosurePost on X with a 22-second demo video

Sources: NebuSec on X, 29 Oct 2026; The Hacker News, 29 Oct 2026; Telegram Android source 12.10.3 vs 12.10.4; tgcalls, 21 Apr 2026; NVD search, 29 Oct 2026; CISA KEV 2026.10.28. Status labels and arithmetic: Thorsten Meyer.
Powered by Thorsten Meyer AI

Why the phone call is a classic target

A call is the rare feature that is built to accept data from strangers, instantly, before you have decided anything. To ring at all, your app must read setup messages from someone you never accepted. Once you answer, it must unpack a stream of audio, video and status packets in real time. That work is done in fast, low-level C and C++ code, where one wrong read can touch memory it shouldn’t.

Researchers have said this for years. In 2018, Google’s Project Zero wrote that call setup happens “before the user is notified of the call”, while the media stream is processed after pickup, and that “picking up a call is a reasonable action to expect a user to take”. When the researcher fed deliberately broken media packets into a call, an unmodified Chrome crashed “roughly every 30 seconds”. One of the bugs found was the same family as Telegram’s, in my reading: the code looked something up and used the answer without checking it was there.

In 2021, Project Zero showed that Signal, Google Duo, Facebook Messenger, JioChat and Mocha had logic bugs that could make the called phone send audio, or in Duo’s case a few video frames, before the person had answered. That research followed a similar Group FaceTime bug in 2019. All were fixed. The researcher’s summary of the trade-off: setting a call up early “improves performance”, but “greatly increases the remote attack surface”.

And WhatsApp, the best-known case. In May 2019, WhatsApp disclosed a buffer overflow in its calling stack (CVE-2019-3568) that let attackers run code by sending crafted call packets to a phone number. In its lawsuit, WhatsApp said the spyware maker NSO Group sent malicious code to about 1,400 devices, and that it landed whether users answered or let the call ring, according to Lawfare’s summary of the complaint. CISA added the bug to its exploited list in 2022; in May 2025 a US jury ruled for WhatsApp, as TechCrunch reported. WhatsApp has fixed more call bugs since, including one in established video calls in 2022 (CVE-2022-36934).

Why do attackers bother? Because a working chain is worth a lot. In the same trial, an NSO employee testified that the “standard price” for a European customer was $7 million, per TechCrunch.

Thorsten Meyer AI

Pattern

Infographic 02 · Why call code is a target

The call button is a door strangers may knock on.

Calling features have produced serious bugs in nearly every big messenger. The key question for your risk: does the victim have to do anything?

~1,400devices WhatsApp says NSO targeted through its calling bug in 2019

$7MNSO’s “standard price” for a European customer, per trial testimony

5messengers with call logic bugs in one Project Zero study

~30 show often Chrome crashed when fed broken call packets in testing

Strangers may knock

To ring at all, the app must read setup data from someone you never accepted.

Fast, low-level code

Audio, video and status packets are unpacked in real time in C and C++, where one wrong read touches memory.

One tap is easy

“Picking up a call is a reasonable action to expect a user to take.” Project Zero, 2018

• Dec 2018WhatsApp (CVE-2018-6344)Heap corruption from a malformed packet after the call is establishedduring a call
• Jan 2019Group FaceTimeA call could be forced to connect, letting the caller listen inno answer needed
• May 2019WhatsApp (CVE-2019-3568)Buffer overflow via crafted call packets. Used against users, later listed as exploited by CISAanswered or not
• 2019–2020Signal, Duo, Messenger, JioChat, MochaLogic bugs sent audio, or a few video frames, before the person answered. All fixedno answer needed
• Sep 2022WhatsApp (CVE-2022-36934)Integer overflow could run code in an established video callduring a call
• Sep 2026Telegram for Android (fixed in 12.10.4)Status-message bug in the call code; full chain per NebuSec. No attacks seenanswer needed

Setting a call up early “improves performance” but “greatly increases the remote attack surface”.Natalie Silvanovich, Google Project Zero, 2021

Sources: Project Zero, Dec 2018; Project Zero, Jan 2021; WhatsApp advisories; WhatsApp advisories 2022; Lawfare on the WhatsApp complaint; TechCrunch, 30 May 2025; CISA KEV 2026.10.28; The Hacker News, 29 Oct 2026. Interaction labels: Thorsten Meyer.
Powered by Thorsten Meyer AI

One tap versus no tap

This is the most important difference for your risk. The WhatsApp attack in 2019 worked without any action from the victim: “zero-click”. Telegram’s bug, as described, needs you to answer: “one-click”. That one tap is a real barrier. You can refuse it, and Telegram lets you remove it entirely. Its own launch post for calls in 2017 promised that you can “control who can and who can’t call you” and even switch calls off altogether.

It is not the only Telegram security dispute this month. On October 15, the Zero Day Initiative published an unpatched flaw in rlottie, the library Telegram apps used to draw animated stickers (CVE-2026-111105, severity 7.0 of 10). Telegram told ZDI in March that checks on its servers made the bug unreachable, then asked for a complete attack chain. A researcher argues in his OffensiveCon talk abstract that those server checks can be bypassed, and says he chained bugs into code execution on Telegram for iOS. Telegram’s Android app has since replaced rlottie with tlottie, a library written in Rust, a language that rules out whole classes of memory bugs; it is in the 12.10.0 source from August.

Two cases, one pattern in my reading: Telegram questions whether a bug is really exploitable, while researchers say “prove it” is the wrong bar for fixing and labelling it.

AI found it, says NebuSec

NebuSec says its Code Security product, running on OpenAI’s GPT-5.4 model, found the bug. That is the company’s claim; it has not said how much human work went into turning the find into an attack chain. It fits a trend I covered this week: Anthropic says its own model built five working attack chains, and new CVE records have tripled. Machines now re-read old code paths quickly. An old bug in a popular app is no longer safe just because nobody found it in four years.

What this means for companies

• Track app versions, not just CVEs. This fix has no CVE, so a vulnerability scanner that only matches CVE numbers will never flag it. Your mobile device management (MDM) tool can usually report installed app versions; make Telegram 12.10.4 the minimum on managed phones, or block it until updated.
• Write a messenger policy. Decide which messengers are allowed for work, and for phones you don’t manage (bring your own device, BYOD) require automatic app updates as a condition for access to company email and data.
• Protect high-risk people first. Executives, administrators, journalists and finance staff are the likely targets of expensive chains. For them: calls from contacts only, current Android security updates, and fast replacement of phones that no longer get them.
• Ask about patch speed. Here a library fix took about five months to reach the Android app. Ask your critical app vendors how quickly a fix in a shared component reaches every platform.
• Be honest about forensics. No indicators of compromise have been published. If a sensitive phone ran an old version and took unknown Telegram calls, treat that as a question for your mobile security team, not as proof of a hack.

What this means for users

1. Update Telegram now. Open the Play Store, search Telegram, tap Update. If you installed it from telegram.org, use the app’s own update prompt.
2. Check your version. Open Telegram, go to Settings and scroll to the very bottom. It should say “Telegram for Android” with 12.10.4 or higher.
3. Turn on auto-updates. On the Telegram page in the Play Store, tap the three dots and enable auto update.
4. Limit who can call you. Settings, Privacy and Security, Calls, “Who can call me?”. Choose My Contacts, or Nobody if you never use Telegram calls.
5. Decline calls from strangers. Especially until you have updated. Answering is the step the attack needs.
6. Update Android too. The chain needs a separate Android bug. System updates close that link.

No reason to panic: NebuSec saw no attacks, and the demo needed the victim to pick up. But this is a good week to clean up who can reach you. If Meta’s AI features in your messengers worry you too, here is how to limit what Muse can read.

Thorsten Meyer AI

Checklist

Infographic 03 · What to do now

Update, then decide who gets to call you.

The article’s checklist, condensed. Menu names are taken from Telegram’s own Android app text; priorities are my assessment.

For you, today

Five minutes, no new app.

1. Update Telegram in the Play Store, or via the in-app prompt if you installed it from telegram.org
2. Check the version: Settings, scroll to the bottom: “Telegram for Android” 12.10.4 or higher
3. Auto-update on: Play Store, Telegram page, three dots, enable auto update
4. Who can call me? Settings, Privacy and Security, Calls: My Contacts, or Nobody
5. Decline strangers’ calls until you have updated
6. Update Android too. The chain needs a separate Android bug

For companies, in order

Most of it is configuration, not a new product.

1. now Minimum version: Telegram 12.10.4 on managed phones, or block it until updated
2. now Track versions, not only CVEs. This fix has no CVE, so CVE-only scanners miss it
3. this month Messenger policy: which apps are allowed; auto-updates required for BYOD access
4. this month High-risk staff first: calls from contacts only, current Android security updates
5. ongoing Ask vendors: how fast does a shared-library fix reach every platform?

Telegram closed this door in September while fixing a camera bug. Make sure your app has that fix, and decide who gets to knock.Thorsten Meyer · verdict

Based on: The Hacker News, 29 Oct 2026; Telegram Android source 12.10.3 vs 12.10.4; Telegram, 30 Mar 2017. Priorities: Thorsten Meyer.
Powered by Thorsten Meyer AI

Honest limits

• One main source for the chain. The two extra bugs and the full takeover rest on NebuSec’s video and its CEO’s statements to The Hacker News. There is no technical write-up yet.
• The affected range is NebuSec’s. That versions 8.6.2 through 12.10.3 are vulnerable is the company’s statement; I confirmed the bug and the fix only in 12.10.3 and 12.10.4.
• Telegram’s view is second-hand. Its position comes from NebuSec’s account and ZDI’s timeline. I found no public Telegram statement on either case.
• iOS and desktop are open questions. Their code got the same fix earlier; nobody has shown whether the old code was exploitable there.
• Release dates. The 12.10.4 date I use is when Telegram published the source on GitHub (September 24); store rollouts can differ by a day or two.

The takeaway

Messengers treat the call button as a convenience. Attackers treat it as a door that strangers are allowed to knock on. Telegram closed this door in September, mostly by accident, while fixing a camera bug. Make sure your app has that fix, and decide who gets to knock.

For the bigger picture of this week’s security stories, read Attackers Now Go After Your AI Tools.

Sources

• NebuSec on X, October 29, 2026: announcement and demo video; NebuSec research page (no Telegram write-up as of October 29)
• The Hacker News, October 29, 2026: Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls (interview with NebuSec CEO Eten Zou)
• Telegram Android source code: version 12.10.3 (September 17, 2026) and version 12.10.4 (September 24, 2026); tgcalls Fix camera rotation (April 21, 2026); Android 12.10.0 source with tlottie (August 22, 2026)
• Telegram: Voice Calls launch post (March 30, 2017)
• NIST National Vulnerability Database search, October 29, 2026; CISA Known Exploited Vulnerabilities catalog, version 2026.10.28
• Zero Day Initiative: ZDI-26-757 (October 15, 2026); OffensiveCon: Saifeldeen Aziz talk abstract
• Google Project Zero: Adventures in Video Conferencing Part 1 (December 4, 2018); The State of State Machines (January 19, 2021)
• WhatsApp security advisories: archive (CVE-2019-3568, CVE-2018-6344) and 2022 (CVE-2022-36934)
• Lawfare: Summary: WhatsApp Suit Against NSO Group (November 7, 2019); TechCrunch: Eight things we learned from WhatsApp vs. NSO Group (May 30, 2025)