An ordinary Telegram account was enough to run code on an Android phone via an answered voice call, security startup NebuSec disclosed on 29th October, 2026. Telegram fixed the flaw in version 12.10.4, released in late September.
Key Facts
- Telegram for Android versions 8.6.2 through 12.10.3, released between March 2022 and September 2026, are all affected, NebuSec’s chief executive said.
- NebuSec confirmed the flaw in private calls on ARM64 phones and has no evidence yet that it directly affects iOS, desktop, or group calls.
- Version 12.10.4 fixes the flaw, and the app lists its version number at the bottom of the Settings page.
- The flaw carries no CVE identifier, and NebuSec’s website offers no technical write-up of the exploit.
A rotation check read the wrong field
Telegram’s calling code passes short messages between the two apps to set up a call and report its state. One type, MediaState, tells the other side whether the microphone is muted, whether the camera is on, and how the video is rotated. NebuSec says the code reading those messages mishandled missing fields and touched memory it shouldn’t have.
The Hacker News found a matching bug in Telegram’s published source for version 12.10.3. When a MediaState message carried a rotation value, the code checked it. Then it read the video-state field, even if the message had none. Version 12.10.4 reads rotation from the right field, and the calling code behind this message first switched on in 8.6.2.
Remember when scam callers only ask for your password? Good times. Now picking up a wrong call can get you hacked. Telegram RCE discovered by NebuSec Code Security, powered by GPT-5.4. Yes, GPT-5.4. We turned a dinosaur model into a cyber powerhouse. Fixed in Telegram Android 12.10.4（7099)
— NebuSec (@nebusecurity) October 29, 2026
That fix wasn’t new. Telegram’s Android, iOS, and desktop apps share one calling library, tgcalls, where a change labeled “Fix camera rotation” made the same correction on 21st April, 2026. The iOS code picked it up in version 12.7 in May and the desktop code in 7.0.1 in July. Android users waited until September, and nobody has shown whether the older code was exploitable on iOS or desktop.
NebuSec’s evidence stops at a demo video
NebuSec’s video shows an attacker phone calling a victim phone. About half a minute after the victim answers, the screen jumps home, the app icons fall away, and a NebuSec hacking logo appears. The clip never shows which Telegram or Android version the victim ran. So the step from memory bug to running code rests on that video and the company’s word.
The Y Combinator-backed startup says its Code Security product, running on OpenAI’s GPT-5.4, found the flaw. Its X account was blunter: “We turned a dinosaur model into a cyber powerhouse.” In July, NebuSec described an exploit chain that began with a Firefox flaw and reached the kernel of an ARM64 device on Android 17.
Two answers are still missing: whether anyone used the flaw in real attacks, and what an attacker’s code could reach.
The Zero Day Initiative (ZDI) flagged a separate Telegram problem in an advisory on 15th October,2026 : CVE-2026-111105 (CVSS score: 7.0). That unpatched flaw sits in rlottie, the library Telegram apps have used to draw animated stickers. ZDI said it can let an attacker run code if a user opens a malicious file or page. Telegram told ZDI in March that server checks mitigated it, then asked in April for a full remote code execution chain.
What’s Next?
Researcher Saifeldeen Aziz says those checks could be bypassed, according to his OffensiveCon Tokyo talk abstract. His AI-guided fuzzing, which floods code with broken input, found rlottie memory-corruption bugs across Telegram’s apps and chained them to run code on iOS. Android replaced rlottie with tlottie, a Rust library, by version 12.10.0, and desktop followed in September. The iOS code added tlottie in version 13.0 but still includes rlottie.
For Android users, Telegram 12.10.4 or later helps reduce risk from the call flaw. NebuSec’s post lists the fixed build as 7099. The next markers are a CVE assignment and Telegram’s answer on whether anyone exploited the bug before September.
