Telegram for Android flaw lets any Telegram account run code on a phone when the victim answers a voice call (fixed in 12.10.4, no CVE yet)

NebuSec disclosed on 2026-10-29 that an attacker with an ordinary Telegram account can run code on a victim's Android phone once the victim answers a private Telegram voice call. No link or file is needed. The bug is in how Telegram's call library (tgcalls) reads MediaState call-setup messages: it reads a field that may be missing and accesses memory it should not. Affected: Telegram for Android 8.6.2 through 12.10.3 (March 2022 to September 2026). Fixed in 12.10.4, released late September 2026. NebuSec confirmed it on ARM64 phones. It has no evidence so far that iOS, desktop or group calls are affected, although the same tgcalls fix shipped in iOS 12.7 and desktop 7.0.1. The Hacker News found matching code in the 12.10.3 source. There is no technical write-up yet, only a demo video. Whether it was exploited in the wild is unknown. No CVE as of 2026-10-29. Anyone with Telegram for Android on a phone that has not updated is at risk, including company-managed and BYOD devices.

Summary written from the sources below. Check the originals before acting.