Vulnerability in Telegram for Android

A vulnerability in Telegram for Android allowed an attacker to run code on a victim's phone as soon as they answered a voice call. NebuSec, the security firm that discovered the flaw, made it public recently after Telegram released a patch in late September.

Attack method requires minimal access

To exploit the vulnerability, an attacker only needed an ordinary Telegram account. Users are advised to update to version 12.10.4 or newer to protect against the issue, which stemmed from a misinterpreted call message.

Misinterpreted call message causes issue

During a call, Telegram's apps exchange small messages to start and monitor the call. One of these messages, MediaState, provides information about the microphone, camera, and video orientation. The code that reads this message handled missing fields poorly, accessing unintended memory areas.

Flaw corrected in newer version

The issue was observed in the code for version 12.10.3. When the message included a rotation value, the code would check it and then read a video status field even if it didn't exist. The next version, 12.10.4, corrected this flaw.

Vulnerability affects multiple versions

All versions of Telegram for Android from 8.6.2 to 12.10.3, released between March 2022 and September 2026, are affected. NebuSec, a startup backed by Y Combinator, found the flaw using its tool Code Security, based on GPT-5.4 from OpenAI.

No CVE number assigned, iOS not affected

As of October 29, the vulnerability did not have a CVE number, a public identifier for known security flaws. It is unknown if it was used in real attacks. The vulnerability was confirmed on devices with ARM64 processors but not on iOS, computers, or during group calls.

Fix applied across platforms

Telegram calls use the same code library for Android, iOS, and computers, called tgcalls. A fix titled "Fix camera rotation" was implemented in this library on April 21, 2026. iOS received the fix in version 12.7 in May, the desktop app in version 7.0.1 in July, and Android in version 12.10.4.

Telegram calls previously had security issues

Telegram calls have drawn attention before. In October 2018, the desktop application exposed participants' IP addresses during peer-to-peer voice calls until an option was added to disable this feature.