Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls

Summary: NebuSec found a flaw in Telegram for Android's handling of MediaState call-setup messages that, chained with an information-leak bug and an Android root exploit, gave full control of a phone once the victim answered a voice call, affecting versions 8.6.2 through 12.10.3. Telegram fixed it in version 12.10.4, released in late September, but acknowledged NebuSec's September 26 report without accepting the remote-code-execution chain, so no CVE was assigned and no bug bounty was paid.
Why it matters: The attacker needed only an ordinary Telegram account and a call the victim answers, and the flaw sat in versions shipped between March 2022 and September 2026 - a window in which most Android installs likely went unpatched. NebuSec says it has seen no real-world use, but the fix shipped before the report, meaning exposure depended on users updating on their own.

Read the original at The Hacker News ↗