A security startup called NebuSec says a flaw in Telegram for Android let an attacker run code on a victim’s phone through a voice call, once the victim answered. The attacker needed only an ordinary Telegram account. Telegram fixed the flaw in version 12.10.4, released in late September, and NebuSec disclosed it on October 29, according to The Hacker News. As of October 29 the flaw had no CVE identifier, and The Hacker News says it has asked NebuSec and Telegram whether it was used in real attacks.
During a call, the two apps exchange short setup and status messages. One type, MediaState, reports whether the microphone is muted, whether the camera is on, and how the video is rotated. NebuSec says the code that reads these messages did not handle missing fields properly and accessed memory it should not. The Hacker News checked Telegram’s published source code for version 12.10.3 and found a flaw matching that description: the code checked a rotation value and then read a different field, the video state, even when the message had none. Version 12.10.4 reads the rotation value from the right field.
NebuSec’s video shows one phone calling another. The victim accepts, and about half a minute later their phone returns to its home screen and shows a “HACKED BY NEBUSEC” logo. The Hacker News notes that the video does not show the phone’s Telegram or Android version, and that no technical write-up was on NebuSec’s site as of October 29, so how the memory flaw leads to running code rests on the video and on what the company says. NebuSec has not said what an attacker’s code could reach.
How to check if you’re affected
Affected versions are Telegram for Android from 8.6.2 through 12.10.3, which NebuSec’s chief executive told The Hacker News were released between March 2022 and September 2026. NebuSec confirmed the flaw in private calls on ARM64-based phones and says it has no evidence so far that it directly affects Telegram’s iOS and desktop apps or group calls.
- Open Telegram, go to Settings and look at the version number at the bottom of the page. If it is lower than 12.10.4, update the app from your app store.
- Until you have updated, consider declining voice calls from numbers or accounts you do not know. This is our precaution rather than guidance from NebuSec or Telegram.
- The same shared calling library, tgcalls, is used by Telegram’s Android, iOS and desktop apps. The Hacker News traced a “Fix camera rotation” change in tgcalls dated April 21, 2026, which reached iOS in version 12.7 and desktop in version 7.0.1. Whether the earlier code in those apps could be exploited has not been shown.