NebuSec disclosed on October 29, 2026, that answering a one-to-one Telegram for Android voice call could trigger a chain of bugs leading to code execution. The identified parser defect had already been corrected in version 12.10.4, released in late September. NebuSec says it reported the issue to Telegram on September 26, after that version had shipped.
Which Telegram for Android versions did NebuSec identify?
NebuSec identified Telegram for Android versions 8.6.2 through 12.10.3 as affected. Version 12.10.4 contains the reported parser correction. The affected range and the corrected release were reported by NebuSec and Telegram, respectively.
What role did answering a call play?
NebuSec said an attacker with a regular Telegram account could trigger the reported chain if the recipient answered a one-to-one voice call. It described combining the Telegram flaw with an information leak and an Android root exploit, with potential access to messages, the microphone, and the camera. These are NebuSec’s claims about the chain and its impact.
NebuSec co-founder and CEO Eten Zou said declining the call or setting Telegram’s call privacy to “Nobody” would block the call-dependent trigger. Zou also said Telegram acknowledged the report but did not believe the defect could be turned into remote code execution. As of October 29, 2026, NebuSec said it had not seen the flaw used in real attacks.
What changed in versions 12.10.3 and 12.10.4?
The code difference is in how Telegram for Android parses the videoRotation field in a MediaState message, which carries call media information. In version 12.10.3, the parser checks for videoRotation but reads the rotation value from videoState. In version 12.10.4, it reads the value from videoRotation. The 12.10.3 source and 12.10.4 source show the field change.
| Telegram for Android version | Rotation-field access |
| 12.10.3 | Checks videoRotation, then reads the value from videoState |
| 12.10.4 | Reads the value from videoRotation |
What should Telegram for Android users do?
Check the installed app version and update to version 12.10.4, the reported corrected release. Declining an unexpected one-to-one call or setting call privacy to “Nobody” addresses the trigger described by NebuSec; Zou presented those measures as call precautions, not as a replacement for updating.
