Telegram para Android · Disclosed

Telegram Patches Android Flaw That Ran Code When Users Answer Calls

Oct 29, 2026 · 1 min read

A flaw in Telegram for Android let an attacker run code on a victim's phone as soon as the victim answered a voice call; the attacker needed only an ordinary Telegram account. Telegram fixed the issue in version 12.10.4, released in late September, and NebuSec disclosed it on October 29. Update the app to version 12.10.4 or later.

By HIFY Radar newsroom Updated 10/29/2026 09:22 AM Get this every day →← Back to the feed 1 source

HighVulnerabilityDisclosedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A flaw in Telegram for Android allowed an attacker to run code on a victim's phone as soon as the victim answered a voice call. The attacker needed only an ordinary Telegram account. Telegram has already fixed the issue in version 12.10.4.

Why it matters

Any employee using Telegram for Android could be compromised just by answering a call, with no link click or file open required. Such an attack can give the intruder access to the device and its conversations. The fix has existed since late September, but outdated devices remain exposed.

What to do

Update Telegram for Android to version 12.10.4 or later on every company phone. Check for devices still running older app versions.

For the technical team

Affected: Telegram para Android · Telegram for Android; the flaw was fixed in version 12.10.4. The source begins to say the flaw can be triggered 'in every version from', but the text is cut off and does not state the start of the range; treat versions prior to the fix as affected.
Exploitation: The source reports no in-the-wild exploitation and no public PoC. Disclosed by NebuSec on October 29; fix released by Telegram in late September.
Fix: Telegram for Android version 12.10.4, released in late September.
Vector: Telegram for Android; code execution on the victim's device triggered at the moment the victim answers a voice call. Condition: the attacker needed only an ordinary Telegram account; the victim only had to answer the call.
More details: Discovery and disclosure are attributed to NebuSec, a security startup, according to The Hacker News. The fix preceded the public disclosure.