A significant security flaw in Telegram’s Android application allowed attackers to execute code on a user’s device by merely answering a voice call. This vulnerability, discovered by the cybersecurity firm NebuSec, has been addressed in the latest update of the app, version 12.10.4, which was released in late September.
Details of the Vulnerability
The flaw was present in versions 8.6.2 through 12.10.3 of the Telegram app for Android, according to NebuSec’s co-founder. These versions were released between March 2022 and September 2026. The issue was related to the app’s handling of MediaState messages during calls, which allowed unauthorized memory access.
NebuSec confirmed the exploitability of the flaw on ARM64-based devices, but there is no current evidence suggesting that Telegram’s iOS or desktop applications, or group calls, are affected by this vulnerability.
Implications and User Recommendations
The vulnerability did not have a Common Vulnerabilities and Exposures (CVE) identifier at the time of disclosure on October 29. Users of Telegram on Android are advised to update to version 12.10.4 or later to mitigate possible security risks. The version number can be verified at the bottom of the app’s Settings page.
While NebuSec and Telegram have not confirmed any real-world exploits leveraging this vulnerability, users are urged to update their applications as a precautionary measure.
Response and Additional Findings
NebuSec’s investigation involved a video demonstration showing the potential consequences of the exploit, with visual indicators of a successful breach. The startup, supported by Y Combinator, utilized its Code Security product powered by OpenAI’s GPT-5.4 model to uncover the flaw.
Separately, another unpatched vulnerability was reported in the rlottie library used by Telegram for animated stickers. This flaw, identified by the Zero Day Initiative (ZDI), could potentially allow code execution by opening a malicious file or page. Telegram has since replaced rlottie with the Rust-based tlottie library in its Android and desktop versions, while the iOS platform incorporated this change in October.
These developments underscore the importance of keeping applications up to date and highlight the ongoing efforts by security researchers to identify and patch vulnerabilities in widely used software.
