{"id":"TECH-202610-telegram-for-android-flaw-lets-any-telegram-account-run-code","kind":"technique","aliases":[],"related":[],"title":"Telegram for Android flaw lets any Telegram account run code on a phone when the victim answers a voice call (fixed in 12.10.4, no CVE yet)","description":null,"summary":"NebuSec disclosed on 2026-10-29 that an attacker with an ordinary Telegram account can run code on a victim's Android phone once the victim answers a private Telegram voice call. No link or file is needed. The bug is in how Telegram's call library (tgcalls) reads MediaState call-setup messages: it reads a field that may be missing and accesses memory it should not. Affected: Telegram for Android 8.6.2 through 12.10.3 (March 2022 to September 2026). Fixed in 12.10.4, released late September 2026. NebuSec confirmed it on ARM64 phones. It has no evidence so far that iOS, desktop or group calls are affected, although the same tgcalls fix shipped in iOS 12.7 and desktop 7.0.1. The Hacker News found matching code in the 12.10.3 source. There is no technical write-up yet, only a demo video. Whether it was exploited in the wild is unknown. No CVE as of 2026-10-29. Anyone with Telegram for Android on a phone that has not updated is at risk, including company-managed and BYOD devices.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Telegram for Android","fixed":["12.10.4"],"vendor":"Telegram","affected":">= 8.6.2, < 12.10.4","ecosystem":"android"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"Check the Telegram for Android version (shown at the bottom of Telegram Settings, or in MDM app inventory for org.telegram.messenger). Versions 8.6.2 through 12.10.3 are affected. Exploitation indicators: unknown.","fix":"Update Telegram for Android to 12.10.4 or later. Use MDM to enforce the minimum version on managed devices. Until a phone is updated, do not answer Telegram calls from unknown accounts, or limit who can call you in Settings > Privacy and Security > Calls.","status":"open","published_at":"2026-10-29T00:00:00+00:00","first_seen_at":"2026-10-29T12:26:03+00:00","triaged_at":"2026-10-29T12:26:03+00:00","updated_at":"2026-10-29T12:26:03+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':51B,202B '-202610':28A '-29':52B,203B '12.10.3':121B,174B '12.10.4':23A,129B '12.7':162B '2022':123B '2026':50B,126B,133B,201B '7.0.1':165B '8.6.2':119B 'access':110B 'account':8A,37A,60B 'affect':115B,153B 'although':154B 'android':3A,32A,42A,68B,118B,208B 'answer':17A,73B 'any':35A 'anyon':204B 'arm64':138B 'attack':55B 'bug':86B 'byod':224B 'call':20A,78B,92B,98B,151B 'call-setup':97B 'code':10A,39A,63B,171B 'compani':221B 'company-manag':220B 'confirm':135B 'cve':25A,198B 'demo':186B 'desktop':148B,164B 'devic':225B 'disclos':48B 'earli':44B 'early-warn':43B 'evid':143B 'exploit':191B 'far':145B 'field':104B 'file':82B 'fix':21A,127B,158B 'flaw':4A,33A 'for':31A,41A 'found':169B 'group':150B 'hacker':167B 'includ':219B 'io':147B,161B 'late':131B 'let':5A 'lets':34A 'librari':93B 'link':80B 'manag':222B 'march':122B 'match':170B 'may':106B 'mediast':96B 'memori':111B 'messag':100B 'miss':108B 'nebusec':47B,134B 'need':84B 'news':168B 'ordinari':58B 'phone':13A,69B,139B,211B 'privat':75B 'read':95B,102B 'releas':130B 'risk':218B 'run':9A,38A,62B 'septemb':125B,132B 'setup':99B 'ship':159B 'sourc':175B 'tech':27A 'technic':179B 'techniqu':46B 'telegram':1A,7A,30A,36A,40A,59B,76B,90B,116B,206B 'telegram-for-android-flaw-lets-any-telegram-account-run-code':29A 'tgcall':94B,157B 'unknown':196B 'updat':215B 'victim':16A,66B,72B 'video':187B 'voic':19A,77B 'warn':45B 'whether':188B 'wild':194B 'write':181B 'write-up':180B 'yet':26A,183B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202610-telegram-for-android-flaw-lets-any-telegram-account-run-code","url":null,"severity":null,"published_at":"2026-10-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-29T12:26:03+00:00","fetched_at":"2026-10-29T12:26:03+00:00","note":null}],"documents":[{"id":16139,"url":"https://x.com/TheHackersNews/status/2115773169508450333","title":"@TheHackersNews: ‼️ One answered Telegram call was enough to run attacker code on Android, resear","kind":"post","source":"x","publisher":null,"text":"‼️ One answered Telegram call was enough to run attacker code on Android, researchers say.\n\nAll an attacker needed was a regular Telegram account. No link or file to open.\n\nFixed in Telegram for Android 12.10.4.\n\nDetails ↓ https://t.co/ib5MdunIUi https://t.co/aUxWaL1aqt\n\nlikes 107 reposts 27","published_at":"2026-10-29T11:50:07+00:00","relation":"describes","confidence":null,"note":null},{"id":16405,"url":"https://thehackernews.com/2026/10/telegram-android-flaw-lets-attackers.html","title":"Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls","kind":"blog","source":"analyst","publisher":null,"text":"NebuSec (security startup) disclosed on 2026-10-29 a flaw in Telegram for Android: an attacker with an ordinary Telegram account can run code on the victim's phone once the victim answers a private voice call. Affects Telegram for Android 8.6.2 through 12.10.3 (March 2022 - September 2026); fixed in 12.10.4 (late September 2026). Confirmed on ARM64 phones; no evidence yet for iOS, desktop or group calls. Bug in the tgcalls code that parses MediaState call-signalling messages (mic/camera/rotation): with a rotation value present, it read the video-state field even when missing (out-of-bounds memory access). The Hacker News confirmed matching code in 12.10.3 source; tgcalls fix 'Fix camera rotation' 2026-04-21, in iOS 12.7 (May) and desktop 7.0.1 (July); exploitability there not shown. No CVE as of Oct 29. No technical write-up on NebuSec site; demo video only. In-the-wild exploitation unknown (THN asked). Separately: rlottie CVE-2026-111105 (ZDI, unpatched), sticker zero-click research by Saifeldeen Aziz at OffensiveCon Tokyo; Android replaced rlottie with tlottie between 12.8.1 and 12.10.0.","published_at":"2026-10-29T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}