Telegram bug on Android let a voice call take over phones

Security startup NebuSec says a bug in Telegram for Android let an attacker take over a phone through a voice call. The victim only had to answer. The attacker needed nothing more than an ordinary Telegram account. Telegram fixed the flaw in version 12.10.4, released in late September, and NebuSec went public on October 29.

What happened

When two Telegram apps start a call, they swap short setup messages. One type, called MediaState, reports whether the microphone is muted, whether the camera is on, and how the video is rotated. The flaw sat in the code that reads those messages. According to NebuSec, it handled missing fields badly and reached into memory it should not touch.

The Hacker News checked Telegram's published code for version 12.10.3 and found a flaw matching that description. The code checked a rotation value, then read a different field, the video state, even when the message did not include it. Version 12.10.4 reads the right field.

NebuSec's video shows a victim accepting a call. About half a minute later, the phone jumps to its home screen, the app icons fall down the display, and a "HACKED BY NEBUSEC" logo appears. The video does not show which Telegram or Android version the phone was running.

Who it affects

Every Android version from 8.6.2 through 12.10.3 can be triggered, NebuSec says. Those versions span March 2022 to September 2026. The company confirmed the attack in private calls on ARM64-based phones, a common type of phone chip. It has no evidence so far that Telegram's iPhone and desktop apps or group calls are directly affected.

What to do

The alert box above lists the steps. In short, check your version in Settings, update from the Google Play Store if needed, and be wary of calls from people you do not know until then.

What is not known yet

• Whether anyone used the flaw in real attacks. The Hacker News has asked NebuSec and Telegram.
• What an attacker's code could actually reach on a phone.
• How the flaw leads to running code. NebuSec had no technical write-up online as of October 29.
• The flaw had no CVE identifier, the public tracking number for security bugs, as of October 29.

A separate Telegram issue

A different problem surfaced two weeks earlier. On October 15, the Zero Day Initiative published an advisory about an unpatched flaw in rlottie, a library Telegram apps have used to draw animated stickers. It is tracked as CVE-2026-111105 and can let an attacker run code if a user opens a malicious file or page.

Telegram's Android app replaced rlottie with a newer library called tlottie between versions 12.8.1 in June and 12.10.0 in August. The iPhone code added tlottie in version 13.0 in October but still includes rlottie.