Telegram Android flaw could run code when users answer calls

A security researcher team, NebuSec, says a flaw in Telegram for Android could allow an attacker to run code on a victim’s device when the user answers an incoming voice call. The attack would require only an ordinary Telegram account.

NebuSec’s public materials include a video showing a device displaying a “HACKED BY NEBUSEC” banner during a Telegram call, but Telegram and NebuSec have not published a formal technical write‑up or disclosed a working exploit chain, and there is no confirmed public evidence of real-world use at this stage.

Telegram confirms the issue was present in Android versions from 8.6.2 to 12.10.3 and fixed with version 12.10.4, released in September 2026; the company says the flaw has not been shown to affect iOS or desktop apps or group calls. As of 29 October 2026, the vulnerability did not have a CVE identifier.

The underlying bug lies in how MediaState messages used during calls are parsed. NebuSec’s analysis, based on Telegram’s open‑source code, indicates that when a rotation value is present the code reads a different field (the video state) even if that field is absent, causing memory access issues.

Telegram’s developers reportedly addressed the same rotation handling bug in the shared tgcalls library across platforms, with an April 2026 fix for camera rotation; iOS and desktop components received related updates, but whether earlier Android code could be exploited outside Android remains unproven.

Separately, the Zero Day Initiative disclosed a remote‑code‑execution risk in rlottie, tracked as CVE‑2026‑111105, which Telegram uses for animated stickers; ZDI noted server checks could be bypassed, and Telegram has been working with ZDI on mitigations. There is no confirmed exploitation knowledge linking the rlottie issue to the Telegram Android flaw.