Telegram Android Flaw Allowed Code Execution Through a Simple Voice Call
A security weakness in Telegram's Android app let an attacker execute code on a victim's device the moment a voice call was answered, according to research published by security startup NebuSec and reported by The Hacker News. The bug required nothing more than an ordinary Telegram account to exploit, which raises uncomfortable questions about how much trust users place in the voice-call path of a mainstream messaging app.
What happened
According to the report, the flaw affected Telegram for Android across a broad range of versions, and it could be triggered once the target picked up an incoming voice call. The attacker did not need a compromised account, a leaked phone number from a privileged source, or any special access to Telegram's infrastructure. A standard account was sufficient. Telegram addressed the issue in version 12.10.4 of the Android app, which shipped in late September, and NebuSec went public with its findings on October 29.
The timing is notable. Roughly a month passed between the fix and the public disclosure, a window that presumably gave Telegram time to push the update to users and gave defenders time to prepare. Even so, mobile app updates are notoriously slow to propagate, and anyone still running an older build of Telegram for Android should treat the patch as urgent rather than optional.
Why voice calls are a sensitive surface
Voice and video calling features are often bolted onto messaging clients as a convenience layer, but they carry a large attack surface. Call setup involves signaling, media negotiation, and codec handling, all of which parse data supplied by the other party before the user has done anything beyond tapping "answer." When a flaw in that pipeline allows code execution, the act of accepting a call becomes the exploit trigger. That is a meaningfully different risk profile from a malicious link or attachment, because it removes the usual user-decision point where someone might notice something suspicious.
NebuSec's finding also underscores a broader pattern in mobile messaging security: the trust boundary between "someone who can message me" and "someone who can run code on my phone" should be wide, and any narrowing of that gap is a serious matter. Attackers with only a normal account are cheap and easy to obtain, which makes flaws like this attractive to anyone from opportunistic criminals to more targeted operators.
The disclosure gap
The public report does not detail the technical root cause of the flaw, the precise mechanism by which code execution was achieved, or whether exploitation was observed in the wild. Those gaps are common in coordinated disclosures, particularly when a vendor fixes an issue quietly ahead of a researcher's write-up. Readers should be cautious about drawing firm conclusions about real-world abuse from the absence of such reporting; a lack of evidence is not evidence of absence, but neither is it proof of active exploitation.
What is clear is the remediation path. Telegram shipped the correction in 12.10.4, and the version number matters. Users who have automatic updates enabled on Android are likely already protected, but those who sideload the app, disable auto-updates, or use modified builds should verify their installed version manually. Enterprise and security teams that permit Telegram on managed Android devices should check compliance reporting to confirm which endpoints are still running older releases.
Practical takeaways
- Verify your version. Confirm Telegram for Android is on 12.10.4 or later. Do not assume an app store update has landed.
- Treat call answering as an action with risk. While this specific flaw is patched, the incident is a reminder that accepting calls from unknown contacts is not a zero-risk activity.
- Review managed device policies. Organizations that allow consumer messaging apps should have visibility into installed versions and a mechanism to flag outdated software.
- Watch for follow-up research. NebuSec's disclosure may be followed by a deeper technical write-up, which would be valuable for defenders building detection coverage around messaging clients.
The bigger picture
Messaging apps have become critical infrastructure for both personal and business communication, and their feature sets keep expanding into calling, file transfer, and payments. Each new capability is another parser handling untrusted input. The Telegram Android case is a useful reminder that patching cadence, not just feature parity, is a security property worth evaluating when choosing which apps to trust with a microphone, camera, and address book.
For now, the fix exists and the disclosure is public. The remaining work is the unglamorous part: making sure every Android device in reach is actually running it.
Source: The Hacker News — Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls
