October 31, 2026
Telegram Android Vulnerability Allow Code Execution Through Voice Calls
A recently disclosed security flaw in Telegram for Android has raised concerns among users and security professionals alike. Researchers…
By Cybersectoworld
4 min read
A recently disclosed security flaw in Telegram for Android has raised concerns among users and security professionals alike. Researchers from cybersecurity startup NebuSec revealed that attackers could potentially exploit a vulnerability in Telegram's voice-calling feature and combine it with additional flaws to gain control of a victim's Android device.
What makes this issue particularly notable is its simplicity from an attacker's perspective. According to the researchers, the attacker only needed a regular Telegram account and the victim to answer a Telegram voice call. When chained with other vulnerabilities, the flaw could potentially allow attackers to escape the Telegram application and execute code on the target device.
The vulnerability affected Telegram for Android versions 8.6.2 through 12.10.3 and was addressed in version 12.10.4, released in September 2026. Researchers publicly disclosed their findings on October 29, 2026.
While there is currently no evidence that the flaw has been exploited in real-world attacks, the discovery highlights the importance of keeping mobile applications updated and maintaining a proactive approach to device security.
What users should do now: Android users should verify that they are running Telegram version 12.10.4 or later and install any available updates immediately. Additionally, users concerned about potential exposure can restrict who is allowed to call them through Telegram's privacy settings.
How Could a Voice Call Lead to Device Compromise?
According to NebuSec, the vulnerability exists within Telegram's voice-calling functionality. During a call, Telegram exchanges various messages between devices to manage call settings such as microphone status, camera activation, and video orientation.
Researchers found that Telegram's Android application did not properly validate certain call-related data. By sending specially crafted information during a voice call, an attacker could trigger unexpected behavior inside the application. On its own, this bug was not enough to completely compromise a device, but it provided an important stepping stone for a more advanced attack chain.
When combined with an additional information disclosure vulnerability, the attacker could potentially escape Telegram's application environment and interact with the Android operating system itself. If a separate privilege escalation or root-level vulnerability was also available, the attacker could theoretically gain extensive control over the device.
In a successful attack scenario, a threat actor could potentially access sensitive data, monitor communications, or misuse hardware components such as the microphone and camera. However, researchers emphasized that the attack required the victim to receive and answer a Telegram voice call, making user interaction a necessary part of the chain.
The good news is that no evidence has emerged suggesting that the vulnerability was exploited in real-world attacks before being patched. Researchers also stated that they were not aware of any other parties actively using the flaw.
Patch Available: What Users Need to Know
Telegram has addressed the vulnerability in version 12.10.4 for Android, which was released in September 2026. Users running older versions are strongly encouraged to update immediately to reduce their exposure to potential attacks.
According to NebuSec, the company responsibly reported the issue to Telegram after identifying the flaw. While Telegram acknowledged the report, researchers stated that there was disagreement regarding the severity and exploitability of the vulnerability. At the time of disclosure, the issue had not been assigned a CVE identifier.
Researchers also noted that they have not observed the flaw being exploited in the wild. Their findings were demonstrated in a controlled environment, where a proof-of-concept attack showed how a vulnerable device could be compromised after accepting a Telegram voice call.
Although the reported vulnerability primarily affects Telegram for Android, there is currently no public evidence indicating that Telegram's iOS, desktop, or group calling functionality can be exploited in the same manner. Nevertheless, users across all platforms should maintain good security practices and keep their applications updated.
Recommended Security Measures
To minimize risk, Telegram users should:
- Update Telegram to the latest available version.
- Apply Android security updates as soon as they become available.
- Review Telegram's privacy settings and restrict who can call them.
- Avoid answering unexpected calls from unknown contacts.
- Maintain good mobile security hygiene by keeping apps and operating system components up to date.
This incident serves as another reminder that even popular messaging platforms can contain security flaws. Regular updates remain one of the most effective defenses against newly discovered vulnerabilities.
What This Means for Telegram Users
The recently disclosed Telegram Android vulnerability highlights an important reality of modern cybersecurity: even widely used and trusted communication platforms can contain security flaws that remain unnoticed for years.
In this case, researchers demonstrated how a seemingly small issue in Telegram's voice-calling functionality could become significantly more dangerous when combined with additional vulnerabilities. While there is currently no evidence that the flaw was exploited in real-world attacks, its discovery underscores the growing complexity of modern exploit chains and the importance of responsible vulnerability research.
Fortunately, Telegram has already released a fix, and users can protect themselves by ensuring they are running the latest version of the application. Organizations should also encourage employees to keep mobile applications updated and follow secure communication practices, especially when business communications rely on messaging platforms.
Key Takeaways
- A vulnerability affecting Telegram for Android could be triggered through a voice call.
- The flaw impacted versions 8.6.2 through 12.10.3 and was fixed in version 12.10.4.
- Researchers demonstrated that the issue could potentially be chained with additional vulnerabilities to achieve device compromise.
- No evidence of active exploitation has been reported at the time of disclosure.
- Users should update Telegram immediately and apply all available Android security updates.
- Restricting Telegram call permissions and avoiding calls from unknown contacts can further reduce risk.
As cyber threats continue to evolve, timely software updates remain one of the most effective security measures available. Regular patch management, security awareness, and proactive monitoring help reduce the risk posed by newly discovered vulnerabilities before threat actors have an opportunity to exploit them.