A security flaw discovered in the Telegram app for Android could allow an attacker to compromise a smartphone once the owner answers a voice call. Telegram patched the issue in version 12.10.4, released in late September; however, details regarding the vulnerability were only disclosed on October 29, according to The Hacker News.
Devices running older, unupdated versions of the app remain vulnerable. Eten Zu, co-founder and CEO of NebuSec, explained to the publication that an attacker simply needs to place a call to the user via the messaging app. Affected versions range from 8.6.2 to 12.10.3—released between March 2022 and September 2026. Users can check their version number at the bottom of the app’s settings page; versions 12.10.4 and later are considered secure.
The flaw does not grant full access on its own; rather, it is chained with two other vulnerabilities. First, malicious code escapes the Telegram environment and enters the Android operating system. Then, a separate Android vulnerability provides control over the device, including access to private messages, the microphone, and the camera. NebuSec confirmed this behavior through test calls on phones equipped with ARM64 processors. There is no evidence that the issue affects the iOS or desktop versions of the app, nor does it appear to impact group calls.
The vulnerability stemmed from an error in the code responsible for processing “MediaState” service messages—which track the status of the microphone, camera, and video orientation. If a specific field was missing, the program would attempt to access memory locations it was not authorized to reach. This same flaw was addressed in the tgcalls shared library—used for handling calls—on April 21, 2026.
About the Author
