Overview
A vulnerability in Telegram for Android could allow an attacker to execute code on a victim’s device simply after the victim answered a Telegram voice call. The flaw was fixed in Telegram for Android 12.10.4, released in September, and affects versions from 8.6.2 through 12.10.3 according to the researchers who discovered it. The incident highlights an uncomfortable reality for mobile security: the attack surface is not always a file, link or application. Sometimes it is an ordinary interaction the user has no reason to consider dangerous.
The Call Itself Became the Attack Surface
The vulnerability exists in the code responsible for processing information exchanged during Telegram calls. During a call, the applications exchange messages describing the state of the media session, including information such as whether the microphone or camera is enabled and how video should be rotated. A flaw in the handling of one of these messages could cause the application to access memory incorrectly. According to NebuSec, this could ultimately be exploited to execute code on an Android device after the victim answered a voice call. That changes the traditional phishing model. There is no requirement for the victim to click a suspicious attachment. The call is the delivery mechanism.
A Small Coding Error Can Create a Large Security Boundary
The underlying problem involved incorrect handling of missing fields in a MediaState message. The vulnerable code checked one value and then attempted to access another field without correctly establishing that the field existed. This type of memory-safety error can appear relatively small when viewed in isolation. However, when the vulnerable code processes data received from another device, the security implications become much greater. The important architectural question is not simply whether the application contains a coding error. It is whether attacker-controlled data can reach that code without sufficient validation. In this case, the answer appears to have been yes.
The User Interaction Was Minimal
NebuSec demonstrated the issue using two phones, with the victim accepting a Telegram call. The demonstration reportedly showed the victim’s device leaving the Telegram interface and displaying a message indicating compromise. However, there is an important distinction between the demonstration and independently verified exploitation details. As of the disclosure, NebuSec had not published a full technical write-up, and the video did not establish the exact Telegram or Android versions used. The researchers also had not established whether the vulnerability had been exploited in real-world attacks. That means organisations should distinguish between a demonstrated security capability and confirmed widespread exploitation. The vulnerability is nevertheless serious enough that affected Android users should update.
The Patch Timeline Also Matters
Telegram’s calling functionality uses a shared tgcalls library across its platforms. The underlying correction appeared in the shared codebase earlier in 2026, while different Telegram applications incorporated the fix at different times. Telegram for Android received the relevant correction in version 12.10.4. This illustrates another important software-security challenge: a fix existing upstream does not necessarily mean every deployed application is protected. The security lifecycle continues through integration, release, distribution and ultimately installation by the user.
Mobile Applications Need Network-Level Thinking
Security teams often concentrate on malicious applications, phishing links and dangerous downloads. Those remain important, but vulnerabilities in communications applications demonstrate why the model needs to be broader. A messaging application processes enormous amounts of externally supplied data — messages, calls, images, documents, stickers and signalling information. Every one of those processing paths can become an attack surface. The separate research referenced in the disclosure around Telegram’s animated-sticker libraries reinforces the same principle: content-processing components can become security boundaries when they handle attacker-controlled input.
Expert in the Cloud Insight
Users are trained to be suspicious of strange links and unexpected attachments. They are not normally trained to treat answering a familiar voice call as a potential security event. That is why vulnerabilities like this are so important. Security cannot depend entirely on user behaviour when the application itself is processing untrusted data. The safest approach is to minimise the amount of trust placed in every input — including the inputs generated by seemingly routine interactions such as accepting a voice call.
Leave a Reply