Telegram Android Voice Call Flaw Potentially Allowed Attackers to Run Code

Security startup NebuSec reported that a vulnerability in Telegram for Android could be chained with two other bugs to achieve remote code execution during voice calls. Telegram addressed the issue in version 12.10.4, released in late September.

According to NebuSec co-founder and chief executive Eten Zou, the vulnerability affects versions 8.6.2 through 12.10.3, released between March 2022 and September 2026. When combined with an information-leak bug and an Android root exploit, the flaw could theoretically allow full device control upon answering a call.

Key Details and Scope

• Affected Versions: Telegram for Android versions 8.6.2 to 12.10.3.
• Resolution: Telegram fixed the issue in version 12.10.4.
• Attack Requirements: The victim must receive and answer a voice call from an ordinary Telegram account.
• Scope Limitations: NebuSec confirmed the behavior in private voice calls on ARM64-based phones and stated there is no evidence of direct impact on iOS, desktop apps, or group calls as of October 29.

Technical Context

NebuSec stated the flaw resides in how MediaState messages—used during calls to report microphone state, camera status, and video rotation—are parsed. A review of Telegram's published source code for version 12.10.3 indicated that the code read a video state field even when the message lacked it if a rotation value was included. Version 12.10.4 corrected this field reading.

Mitigation and Verification

• Update the App: Users should verify their Telegram for Android version is 12.10.4 or later by checking the bottom of the Settings page.
• Call Privacy Settings: Changing Telegram's call privacy setting to "Nobody" or declining incoming calls can block the attack vector.
• Unknowns: As of October 29, the flaw did not have a CVE identifier, NebuSec had not observed the issue used in real-world attacks, and no comprehensive technical write-up was published at the time of disclosure.