A critical security vulnerability in Telegram’s Android application could allow attackers to gain complete control of a victim’s smartphone by exploiting a voice call, according to a disclosure from cybersecurity startup NebuSec.
The vulnerability can reportedly be chained with two additional security flaws to escape Telegram’s application environment and compromise the underlying Android operating system. Once successfully exploited, attackers could potentially gain access to sensitive information, including private messages, the device’s microphone, and its camera.
According to NebuSec co-founder and CEO Eten Zou, the attack requires only a regular Telegram account and can be triggered after a targeted user answers an incoming voice call.
Telegram addressed the vulnerability in version 12.10.4, released in late September 2026. NebuSec publicly disclosed the issue on October 29, 2026.
The vulnerability affects Telegram for Android versions ranging from 8.6.2 through 12.10.3, covering releases between March 2022 and September 2026.
Telegram Android Vulnerability Exploits Voice Calls
According to NebuSec, the vulnerability exists in Telegram’s voice-call functionality and can be exploited through specially crafted messages exchanged between devices during a call.
During a Telegram voice call, the applications exchange short messages to establish the connection and communicate call-related information. One such message type, known as MediaState, reports information such as microphone status, camera activation, and video rotation.
NebuSec discovered that Telegram’s code responsible for processing MediaState messages failed to properly handle missing fields.
This could cause the application to access memory incorrectly, potentially triggering a memory corruption vulnerability that can be used as part of a larger exploit chain.
A review of Telegram’s publicly available source code for version 12.10.3 by The Hacker News identified code consistent with NebuSec’s description.
In the vulnerable implementation, when a MediaState message contained a camera rotation value, the application checked that value but subsequently attempted to read another field containing video state, even when that field was missing.
Telegram corrected the issue in version 12.10.4 by ensuring that the rotation value was read from the appropriate field.
Attackers Could Gain Root Access to Android Devices
The vulnerability becomes particularly dangerous when combined with two additional security flaws, according to NebuSec.
The first flaw allows attackers to exploit Telegram’s application environment and access the underlying Android operating system through an escape mechanism.
The second vulnerability involves an Android root exploit that could provide complete control over the compromised device.
By chaining all three vulnerabilities, an attacker could potentially execute arbitrary commands with root privileges.
Successful exploitation could allow attackers to:
- Access private Telegram messages and other sensitive information.
- Activate or access the device’s microphone.
- Access the smartphone’s camera.
- Execute unauthorized commands with root privileges.
- Compromise the confidentiality and security of the entire Android device.
NebuSec confirmed the vulnerability through private voice-call testing on ARM64-based Android devices.
However, the company has not established whether the same attack affects Telegram’s iOS and desktop applications or group calls.
How Users Can Protect Themselves
Telegram has already addressed the vulnerability in Android application version 12.10.4.
Users running older versions should immediately update Telegram to the latest available release.
To check the installed application version:
- Open Telegram on your Android smartphone.
- Navigate to Settings.
- Scroll to the bottom of the page.
- Check the installed application version.
- Update Telegram if the installed version is older than 12.10.4.
NebuSec also identified an additional precaution that could prevent the demonstrated attack.
According to the company, the exploitation process requires the victim to receive and answer a Telegram voice call. Therefore, changing Telegram’s call privacy setting to Nobody can block this attack. Declining suspicious incoming calls also prevents the demonstrated exploitation sequence.
No Evidence of Real-World Exploitation Reported
NebuSec stated that it has not observed the vulnerability being used in real-world cyberattacks.
The company also believes that the flaw had not previously been recognized as a potential remote code execution vulnerability.
NebuSec reported the issue to Telegram on September 26, 2026, after version 12.10.4 had already been released.
According to Zou, Telegram acknowledged the report but did not agree that the vulnerability could be weaponized for remote code execution. Consequently, no CVE identifier was assigned, and the researcher did not receive a bug bounty payment.
As of October 29, Telegram had not publicly provided a detailed technical explanation of the vulnerability.
Telegram’s Shared Calling Library Also Received a Security Fix
The vulnerability is associated with Telegram’s shared calling library, known as tgcalls, which is used across its Android, iOS, and desktop applications.
A code change titled “Fix camera rotation” was introduced into the shared library on April 21, 2026, addressing the underlying issue.
However, the correction reached different Telegram platforms at different times.
- Telegram for iOS: Included the correction starting with version 12.7, released in May 2026.
- Telegram Desktop: Included the correction starting with version 7.0.1, released in July 2026.
- Telegram for Android: Received the correction in version 12.10.4, released in September 2026.
Although the same underlying code was used across multiple platforms, researchers have not demonstrated whether the earlier vulnerable implementation could be exploited in Telegram’s iOS and desktop applications.
NebuSec Demonstrates Telegram Android Exploit
NebuSec published a demonstration video showing how the attack could compromise an Android smartphone through a Telegram voice call.
The demonstration features two devices, identified as the attacker and the victim.
After the victim accepts an incoming Telegram call, the attack progresses in the background. Approximately 30 seconds into the call, the victim’s smartphone switches to its home screen, followed by an animation in which application icons fall down the display.
The demonstration concludes with a message displaying “HACKED BY NEBUSEC.”
However, the video does not identify the Telegram or Android version used on the victim’s device.
As of October 29, NebuSec had not published a detailed technical report explaining the complete exploit chain. Consequently, information about the additional vulnerabilities and exploitation process is based primarily on the company’s statements and demonstration.
NebuSec is a Y Combinator-backed cybersecurity startup. Its Code Security product, powered by OpenAI’s GPT-5.4 model, reportedly identified the vulnerability.
In July, the company also described an Android exploit chain that began with a Firefox vulnerability and ultimately reached the kernel of an ARM64 device running Android 17.
Another Telegram Security Issue Involves Animated Stickers
Separately, the Zero Day Initiative (ZDI) published an advisory on October 15, 2026, describing another security vulnerability affecting Telegram applications.
Tracked as CVE-2026-111105, with a CVSS score of 7.0, the vulnerability affects rlottie, a library previously used by Telegram to render animated stickers.
According to ZDI, successful exploitation could allow attackers to execute arbitrary code when a user opens a specially crafted malicious file or webpage.
Telegram reportedly informed ZDI in March that server-side security checks mitigated the vulnerability. However, in April, the company requested a complete remote code execution exploit chain.
Security researcher Saifeldeen Aziz subsequently demonstrated that these checks could be bypassed.
His research, which was also discussed in connection with an OffensiveCon presentation in Tokyo, used AI-guided fuzzing to identify memory corruption vulnerabilities in rlottie across Telegram’s Android, iOS, and desktop applications.
The research also combined these vulnerabilities with weaknesses in how Telegram delivered and validated stickers to achieve code execution in the iOS application.
Telegram has since transitioned away from rlottie in several of its applications, introducing a Rust-based alternative called tlottie.
According to Telegram’s published source code:
- Android replaced rlottie with tlottie between versions 12.8.1 and 12.10.0.
- Telegram Desktop made the same transition in September 2026.
- Telegram for iOS introduced tlottie in version 13.0 in October, while still retaining rlottie in its source code.
Conclusion
The latest Telegram Android security disclosure highlights how seemingly minor application-level coding errors can potentially become entry points for complete device compromise when combined with additional vulnerabilities.
Although NebuSec has not reported evidence of active exploitation, the possibility of gaining remote root access through an ordinary voice call makes this issue particularly concerning.
Android users should ensure they are running Telegram version 12.10.4 or later, avoid answering unexpected calls from unknown accounts, and review their Telegram call privacy settings to reduce exposure to potential attacks.
