An ordinary voice call on Telegram could be used to hack an Android smartphone. Researchers discovered a vulnerability that allowed attackers to execute malicious code after a user answered a call, with the flaw going unnoticed for nearly four years.
On October 29, 2026, researchers at NebuSec disclosed a serious vulnerability in Telegram for Android involving the handling of voice and video calls. According to the researchers, an attacker only needed a regular Telegram account and had to convince the victim to answer an incoming call. No suspicious links, files, or third-party app installations were required.
The flaw had existed in the messenger’s code for approximately four years, affecting Telegram for Android versions 8.6.2 through 12.10.3, released between March 2022 and September 2026. A fix was introduced in version 12.10.4 in late September, but the vulnerability was not publicly disclosed until October 29. According to NebuSec, the flaw was discovered using its proprietary Code Security tool, powered by OpenAI’s GPT-5.4 artificial intelligence model.
During a voice or video call, Telegram exchanges service messages between devices to establish a connection and communicate the call’s status. One such message type, MediaState, contains information about microphone activity, camera status, and video orientation.
Researchers discovered a flaw in how Telegram processed MediaState messages. The application incorrectly handled messages with missing fields, potentially causing it to access invalid memory locations. Specifically, the code checked the video rotation value but then attempted to read another field even when it was absent from the received message. Under certain conditions, memory-handling errors of this kind can allow attackers to execute unauthorized code on a device.
NebuSec demonstrated a potential attack using two smartphones, one acting as the attacker’s device and the other as the victim’s. Approximately 30 seconds after the victim answered a regular Telegram call, the smartphone automatically switched to its home screen. The app icons began falling toward the bottom of the display, after which the message “HACKED BY NEBUSEC” appeared.
The demonstration showed that a call could be used to interfere with a smartphone’s operation. However, the researchers did not publish a complete technical explanation of how the vulnerability was exploited. The video also did not specify the Android or Telegram versions installed on the device. As a result, the exact mechanism used to turn the memory-handling flaw into malicious code execution remains undisclosed.
NebuSec co-founder and CEO Eten Zou told The Hacker News that the vulnerability could be combined with two additional flaws to gain complete control over a smartphone. An additional information disclosure vulnerability could allow an attacker to escape Telegram’s application environment, while a privilege-escalation exploit granting root access could enable control over the device, including access to messages, the microphone, and the camera.
The researchers confirmed that the attack could be carried out during private voice calls on smartphones using the ARM64 architecture. However, there is currently no evidence that the flaw directly affected group calls or Telegram versions for iOS and desktop computers.
According to NebuSec, the company reported the issue to Telegram on September 26, 2026, when version 12.10.4 containing the relevant fix was already available. Telegram representatives acknowledged the report but, according to the researchers, disputed the claim that the flaw could lead to remote code execution. As a result, the vulnerability did not receive a separate CVE identifier, and no bug bounty reward was paid.
The fix changed how MediaState service messages were processed, eliminating the incorrect access to message fields. An analysis of Telegram’s open-source code confirmed that the relevant flaw was present in version 12.10.3 and fixed in 12.10.4. A similar change had previously been made to the shared tgcalls library used by different versions of the messenger, although the possibility of exploiting the older code on iOS or desktop platforms has not been demonstrated.
NebuSec currently has no evidence that the vulnerability has been exploited in real-world cyberattacks. The researchers also suggest that, before their discovery, other attackers may not have been aware that the flaw could be turned into a remote code execution exploit.
Android users are advised to update Telegram to at least version 12.10.4. The installed version can be checked at the bottom of the messenger’s Settings page. Users can also restrict incoming calls under “Privacy and Security” by setting “Who Can Call Me” to “Nobody.” Rejecting suspicious calls can also prevent the attack method described by the researchers.
This is not the first time Telegram’s calling functionality has attracted the attention of cybersecurity researchers. Previous reports described account takeovers involving outdated voicemail systems, where attackers kept a victim’s phone line busy, intercepted an authentication code, and gained access to the account within minutes.
The vulnerability has already been patched, but users running older versions of Telegram for Android may still be at risk. There have been no confirmed cases of exploitation in real-world attacks, so the main recommendation remains straightforward: check the installed Telegram version and update the application.
