V12 demonstrates Android code execution flaw in Telegram

Security firm V12 demonstrated an Android remote code execution (RCE) flaw in Telegram via a video showing a message from a Telegram bot enabling code to run on the device, with the phone’s Calculator app launching as evidence. Do Son, writing for Daily CyberSecurity, notes that Telegram quickly acknowledged the issue and confirmed that the bug in Telegram for Android was fixed the day before the report and pushed to all users.

The publication emphasises that V12 has not released technical details or exploit code, but has provided a SHA-256 hash to prove it possessed the details at the time of the claim.

The report states that the affected software is Telegram for Android, covering builds released prior to this week’s fix, with no explicit version numbers named by either Telegram or V12. It remains unclear which Telegram component failed beyond the generic reference to “Widgets,” and it is also uncertain whether user interaction with the message was required or what privileges the executed code could gain.

Telegram has advised users to install the latest Android client and enable automatic updates, while organisations are urged to push the update via mobile device management. V12’s public disclosure includes no reported attacks in the wild, and no CVE has yet been assigned to this flaw. The article underlines that, given the circulating RCE demo, rapid updating is important to limit potential rebuilding of the exploit.