---
id: "TECH-202610-telegram-for-android-flaw-lets-any-telegram-account-run-code"
kind: "technique"
aliases: []
title: "Telegram for Android flaw lets any Telegram account run code on a phone when the victim answers a voice call (fixed in 12.10.4, no CVE yet)"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Telegram for Android", "fixed": ["12.10.4"], "vendor": "Telegram", "affected": ">= 8.6.2, < 12.10.4", "ecosystem": "android"}]
ecosystems: []
tags: ["early-warning", "technique"]
not_affected_if: []
published_at: "2026-10-29T00:00:00+00:00"
first_seen_at: "2026-10-29T12:26:03+00:00"
updated_at: "2026-10-29T12:26:03+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-29T12:26:03+00:00"}]
---

# Telegram for Android flaw lets any Telegram account run code on a phone when the victim answers a voice call (fixed in 12.10.4, no CVE yet)

NebuSec disclosed on 2026-10-29 that an attacker with an ordinary Telegram account can run code on a victim's Android phone once the victim answers a private Telegram voice call. No link or file is needed. The bug is in how Telegram's call library (tgcalls) reads MediaState call-setup messages: it reads a field that may be missing and accesses memory it should not. Affected: Telegram for Android 8.6.2 through 12.10.3 (March 2022 to September 2026). Fixed in 12.10.4, released late September 2026. NebuSec confirmed it on ARM64 phones. It has no evidence so far that iOS, desktop or group calls are affected, although the same tgcalls fix shipped in iOS 12.7 and desktop 7.0.1. The Hacker News found matching code in the 12.10.3 source. There is no technical write-up yet, only a demo video. Whether it was exploited in the wild is unknown. No CVE as of 2026-10-29. Anyone with Telegram for Android on a phone that has not updated is at risk, including company-managed and BYOD devices.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- android:Telegram for Android affected >= 8.6.2, < 12.10.4 fixed 12.10.4

## How to check

Check the Telegram for Android version (shown at the bottom of Telegram Settings, or in MDM app inventory for org.telegram.messenger). Versions 8.6.2 through 12.10.3 are affected. Exploitation indicators: unknown.

## Fix

Update Telegram for Android to 12.10.4 or later. Use MDM to enforce the minimum version on managed devices. Until a phone is updated, do not answer Telegram calls from unknown accounts, or limit who can call you in Settings > Privacy and Security > Calls.

## Timeline

- 2026-10-29T12:26:03+00:00 analyst

## Documents

- [describes] @TheHackersNews: ‼️ One answered Telegram call was enough to run attacker code on Android, resear https://x.com/TheHackersNews/status/2115773169508450333
- [describes] Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls https://thehackernews.com/2026/10/telegram-android-flaw-lets-attackers.html

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_