Telegram Android Vulnerability: The Voice Call Flaw Fixed in 12.10.4 and What to Do Now

Telegram for Android had a flaw in the code that handles voice calls. Researchers say they chained it with two other bugs to take full control of a phone, using nothing more than an ordinary Telegram account and a call the victim answered. If anyone at your company uses Telegram on an Android phone, make sure it is on version 12.10.4 or later. The fix has been available since late September 2026.

What happened with the Telegram Android flaw

On Thursday, October 29, 2026, the security startup NebuSec disclosed the flaw, and The Hacker News reported on it the same day. NebuSec posted its disclosure on X and has not published a technical write-up, so most of what follows comes from what NebuSec's CEO told The Hacker News. NebuSec says its AI code scanning product found the bug.

According to NebuSec, the attack works like this:

1. The attacker calls the victim from an ordinary Telegram account.
2. The victim answers.
3. A malformed message sent during the call triggers the Telegram bug, which makes the app read memory it should not.
4. NebuSec says it combined this with a second bug that leaks information and an Android root exploit, giving it full control of the phone: messages, microphone and camera.

NebuSec says it reported the issue to Telegram on Saturday, September 26, 2026, two days after version 12.10.4 had already been published. Also according to NebuSec, Telegram acknowledged the report but did not believe the bug could lead to remote code execution, so no CVE was assigned and no bug bounty was paid. Telegram has not publicly confirmed that account. The Hacker News asked Telegram for comment and did not report a reply.

What we checked in Telegram's own source code

Telegram publishes the source code for its Android app on GitHub, so we went to the code instead of relying on the news report.

• Version 12.10.3 (commit dated Thursday, September 17, 2026): in the call signaling code, the function that reads a "media state" message checks that a videoRotation field is present, then reads its value from a different field, videoState. If a message includes the rotation field but leaves out videoState, the app reads from an entry that does not exist. In C++, that is undefined behavior: the app can end up reading memory it should not touch.
• Version 12.10.4 (commit dated Thursday, September 24, 2026): the same function now reads the correct field.
• The shared calling library: Telegram's tgcalls library got the identical fix on Tuesday, April 21, 2026, in a commit titled "Fix camera rotation". The Android app was still shipping the old code five months later.

This confirms that the coding mistake was real and is fixed in 12.10.4. It does not confirm that the mistake can be turned into a full phone takeover. That part is still only NebuSec's claim.

Claimed vs confirmed

What is not known yet

• The other two bugs. NebuSec has not named the information leak or the Android root exploit, so we do not know whether they are already patched or which Android versions they affect.
• A CVE number. None had been assigned as of October 29, 2026, so vulnerability scanners and patch dashboards that track CVEs may not flag this at all.
• NebuSec's video. The video it shared shows a compromised phone but does not show which Telegram or Android version was running.

How to fix the Telegram Android vulnerability this week

However Telegram was installed, the version number at the bottom of Settings is what counts.

Why it matters for a company network

A phone is not just a phone anymore. It holds email, two-factor codes, VPN profiles, shared drives and client conversations. Full control of one device means an attacker can read all of that and listen through the microphone. Sales, logistics and field service teams often use Telegram to talk with vendors and customers, frequently on personal phones that IT never sees.

This attack, as described, needs no link click and no download. The only defense is a patched app or call settings that block strangers. That is why app versions on staff phones belong in your security plan, not just laptops and servers. Our security hardening service covers device and app update policies alongside your website and network.

There is also a patching lesson in the timeline. The fix existed in Telegram's shared library in April but did not reach the Android app until September, and it was described as a camera rotation fix, not a security fix. If you wait for a headline before updating, you are already months behind.

Telegram Android vulnerability questions people are asking

Is Telegram safe to use on Android right now?

On version 12.10.4 or later, this specific bug is fixed. Check the version at the bottom of Telegram's Settings page.

What version of Telegram fixes the voice call flaw?

Version 12.10.4, published to Telegram's source repository on September 24, 2026.

Does the Telegram flaw affect iPhone or Telegram Desktop?

NebuSec says there is no evidence so far. The underlying library fix reached iOS version 12.7 in May and desktop version 7.0.1 in July, according to The Hacker News, but nobody has shown whether older iOS or desktop versions were exploitable.

Has anyone been hacked through this Telegram bug?

No real-world attacks have been reported. That does not prove none happened.

Is there a CVE for the Telegram Android call bug?

Not as of October 29, 2026.

I never use Telegram calls. Do I still need to update?

Yes. The attack needs only an incoming call, not an outgoing one. Updating, or setting calls to Nobody, closes that door.

The bigger lesson

Security fixes often ship quietly under boring names like "fix camera rotation". The businesses that stay safe are the ones that update apps and phones on a schedule, not the ones waiting for a news story to tell them a fix mattered.

To put that schedule in place across your phones, servers and website, see security hardening or get a quote.

Get security alerts like this by email, plus our free checklist, at EPE Security Alerts.

Sources: The Hacker News report on NebuSec's findings; Telegram for Android 12.10.4 source commit; Telegram for Android 12.10.3 source commit; tgcalls "Fix camera rotation" commit.