Telegram call flaw hit Android versions from 2022 to 2026

The attacker needed only an ordinary Telegram account.

NebuSec disclosed the flaw on October 29.NebuSec's video shows two phones, one marked as the attacker and one as the victim.

The victim accepts a call, and about half a minute later the phone switches to its home screen and a "HACKED BY NEBUSEC" logo appears.

The video doesn't show which Telegram or Android version the victim was running.Short messages are exchanged between the applications during a call to initiate it and provide information about the current state.

One of those is called MediaState, and it gives information about whether the microphone is muted, whether the camera is enabled and how the video is rotated.According to NebuSec, the code that processes MediaState did not take into account situations when some of those fields could be missing and read memory from the places where it was not supposed to.

This vulnerability was found in Telegram’s source code published by Hacker News for version 12.10.3.The flaw can be triggered in every version from 8.6.2 to 12.10.3, released between March 2022 and September 2026.

Telegram fixed it in version 12.10.4 in late September.Check your version at the bottom of Settings, and upgrade if you have something less than 12.10.4.

NebuSec reported the vulnerability privately in conversations with ARM64 devices.

At the time of writing, there is no information on whether the flaw is exploitable in the iOS application or the desktop clients or even group calls.The researchers have not revealed anything on the attacks or what code the hackers were able to execute on a device.

No CVE number is available, and NebuSec has not published any technical details, meaning the jump from the vulnerability to execution depends on the video and claims by the company.According to NebuSec, the Code Security product using the GPT-5.4 model from OpenAI discovered the vulnerability.In other news, the Zero Day Initiative disclosed a security flaw in rlottie, the library Telegram uses for rendering animated stickers.

This is CVE-2026-111105.

In the Android application, the developers replaced the Rottie library with another written in Rust between 12.8.1 and 12.10.0.

Telegram call flaw hit Android versions from 2022 to 2026 October 29, 2026.