What We Know About The Call Risk In Telegram For Android

🔍 Read the full analysis: What We Know About The Call Risk In Telegram For Android on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram for Android call handling on October 29, saying an attacker could take control of a phone if the call bug were combined with two additional vulnerabilities and the recipient answered. Telegram Android version 12.10.4, released in September, includes a related code correction; the full exploit chain has not been documented publicly, and NebuSec said it had seen no attacks in the wild.

NebuSec chief executive Eten Zou told The Hacker News that the call-handling flaw alone was not enough to take over a device. The company says it paired the bug with a second flaw that exposed information and an Android root exploit, which would give an attacker administrator-level access. The alleged result included access to a victim’s messages, microphone and camera. NebuSec said the attacker needed a Telegram account and the victim had to answer a private voice call, making the reported method one-click rather than zero-click.

NebuSec said it confirmed the chain in private voice calls on ARM64 Android phones. Its short demonstration video shows a call connecting on a second phone before the victim device returns to its home screen, but the video does not identify the Telegram or Android versions used. As of October 29, the company had not published a technical write-up of the flaw or the other two bugs, so the public evidence does not independently establish how the complete chain works.

The source code for Telegram Android is public. The report says a comparison of versions 12.10.3 and 12.10.4 found a correction in the call code: the earlier version checked that one field in a call-status message was present, then read a different field that the message did not have to contain. Version 12.10.4 reads the expected field. NebuSec reportedly sent its finding to Telegram on September 26, after that version had appeared. Zou said Telegram acknowledged the report but did not consider the issue capable of remote code execution. The source reports no public Telegram response and no bounty payment.

Why Answering a Call Matters

Voice calls are designed to accept connection data from other users, including people outside a recipient’s contacts. That makes call-handling code an important security boundary: a flaw in how an app reads incoming call information could expose a user before they have shared a file or opened a link. Google’s Project Zero wrote in 2018 that picking up a call is “a reasonable action to expect a user to take.”

If NebuSec’s account is accurate, the risk is not simply that an unfamiliar caller could crash the app. The company describes a chain that needed the recipient to answer and then used additional bugs to reach Android-level control. But the distinction matters: the public disclosure does not establish that the call bug by itself compromises a phone, nor does it provide enough technical detail for outside researchers to verify the claimed full takeover.

For individuals, the immediate steps are to install the latest Telegram version available and limit who can call. For organizations, the case also highlights a visibility gap: vulnerability tools that rely only on CVE identifiers may not flag a flaw when, as reported here, no CVE has been assigned. Companies using Telegram on work phones may need to set minimum app versions and messenger rules directly.

Products Worth Considering

DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)

AmazonView Latest Price

Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue

AmazonView Latest Price

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates the Disclosure

NebuSec announced the issue on X on October 29, 2026, with a brief video and said it was fixed in Telegram Android 12.10.4 (7099). The source material places the release of version 12.10.4 on September 24 and Telegram’s receipt of NebuSec’s report on September 26. It also says Telegram acknowledged the report, while the company’s view of the bug’s severity differed from NebuSec’s assessment.

The same correction appears in Telegram’s shared call library, tgcalls, in an April 21, 2026 change titled “Fix camera rotation,” according to the source’s review of public code. The report says the Android source carrying the correction appeared later, and cites The Hacker News for the claim that iOS and desktop apps received the change in May and July. That establishes that related code was corrected in other clients, but does not establish that those versions were exploitable.

As of October 29, the US National Vulnerability Database had no CVE entry for the reported flaw, and the October 28 version of the US Cybersecurity and Infrastructure Security Agency’s known exploited vulnerabilities catalog had no Telegram entry. Those absences do not prove that exploitation never occurred; they indicate that the issue was not listed in those sources at those times.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

The Exploit Chain Is Undocumented

The full chain has not been independently verified in the material available as of October 29. NebuSec has not published technical details of the information-leak bug or the Android root exploit, and its video does not reveal the software versions on the demonstration devices. The source says the call-code flaw matches the description, but that does not by itself confirm that the additional bugs work as claimed or that the entire chain succeeds on a fully updated phone.

NebuSec said it had seen no real attacks. That is not proof that no one exploited the issue. The public information also does not establish whether the reported call bug affected iOS, desktop Telegram or group calls. A shared-library fix and reports that other clients adopted it do not, by themselves, show that those clients were vulnerable. The source found no public Telegram statement, and no CVE had been assigned as of October 29.

Update and Restrict Incoming Calls

Telegram users should update the Android app and check the version shown in Settings. The source identifies version 12.10.4 or later as containing the fix; users should install any newer release offered for their device. Until updated, they can change “Who can call me?” to “My Contacts” or “Nobody” and decline calls from people they do not know.

The next useful developments would be a technical account from NebuSec, a public response from Telegram, or independent analysis of the claimed companion vulnerabilities. Those details could clarify which Android versions and devices are affected, whether current patched phones can be attacked, and whether the issue was exploited before disclosure. Organizations should check app versions on managed devices and decide whether their security monitoring can track software flaws that lack a CVE.

Key Questions

What is the Telegram Android call risk?

NebuSec says a flaw in Telegram’s Android call-handling code could be combined with two other bugs to take control of a phone after its owner answered a private call. The public material does not independently verify the complete chain.

Which Telegram version includes the reported fix?

The source identifies Telegram Android 12.10.4 as containing the correction. Users should update to that version or a newer one available for their device.

Could an attacker take over a phone just by placing a call?

Not according to the account provided: NebuSec says the recipient had to answer, and that the call bug required two additional vulnerabilities to produce a full takeover. The complete method has not been publicly documented.

Were attacks observed in the wild?

NebuSec said it had seen no real attacks as of its October 29 disclosure. That statement does not establish that exploitation never happened.

Are Telegram on iPhone or desktop computers affected?

The available report does not establish that iOS or desktop clients were exploitable, and it says NebuSec had no evidence that those versions or group calls were directly affected. Other Telegram clients reportedly received the related code change, but that is not proof of exposure.

Source: ThorstenMeyerAI.com