Telegram for Android flaw could run code when a user answers a voice call

A vulnerability in Telegram for Android could let an attacker run code on a victim's phone once the victim answered a voice call, according to a report by startup NebuSec covered by The Hacker News on October 29, 2026. NebuSec said the attacker needed only an ordinary Telegram account to abuse the flaw, and Telegram has already shipped a fix.

What happened

According to the report, during a Telegram call the apps exchange short status messages. The flawed code handled one of them, called the MediaState message, which reports details such as microphone, camera and video-rotation state. The Hacker News said the code did not handle missing fields properly: when a rotation value was present, it read the video-state field even if that field was absent, causing it to read memory it should not have. NebuSec characterizes the end result as code execution.

Technical details

NebuSec, a Y Combinator-backed startup, said it found the flaw using its Code Security product, which the company says runs on OpenAI's GPT-5.4 model. The Hacker News reported that its own review of Telegram's published 12.10.3 source code found code matching the described bug. NebuSec confirmed the issue on ARM64 phones and said it has no evidence it directly affects iOS, desktop or group calls. The outlet noted that the same corrective change also appeared in Telegram's iOS build (version 12.7) and desktop build (7.0.1), and that a matching fix went into the shared tgcalls library on April 21, 2026, though whether the earlier code was exploitable on those platforms has not been shown.

How strong is the evidence

The Hacker News was careful about the limits of the public proof. NebuSec published a video showing a victim's phone jumping to the home screen about 30 seconds into a call, with a "HACKED BY NEBUSEC" logo, but the video did not show the device's Telegram or Android version, and as of October 29 the company had published no technical write-up. On that basis, the outlet said the path from the flaw to full code execution rests on the video and the company's statements. No CVE had been assigned, and whether the flaw was used in real-world attacks was unknown; The Hacker News said it asked both NebuSec and Telegram.

What to do

The clear and verifiable step for users is to update. Affected builds reportedly span every Android version from 8.6.2 through 12.10.3, released between March 2022 and September 2026. Telegram fixed the issue in version 12.10.4, released in late September 2026. The report notes that the installed version number appears at the bottom of the app's Settings page, so users can confirm they are on 12.10.4 or later. Until updated, answering voice calls from unknown accounts carries added risk given how the flaw is triggered.