How the flaw worked

Security startup NebuSec disclosed the flaw on 29 October 2026. It affects Telegram for Android versions 8.6.2 through 12.10.3, released from March 2022 to September 2026. An attacker needed only an ordinary Telegram account, and the victim had to answer a voice call for the attack to trigger. Declining the call, or setting call privacy to Nobody, blocks it.

The bug sits in tgcalls, Telegram's shared calling library, in the parser for MediaState call-signalling messages. The code checked one field, rotation, was present, then read a different field, video state, without checking it existed, causing out-of-bounds memory access.

How serious it was

Chained with an information-leak bug and an Android root exploit, NebuSec says the flaw could give full control of the phone, including messages, microphone and camera. It was demonstrated on ARM64 Android phones in private calls. There is no evidence of real-world exploitation so far, and no evidence of impact on iOS, desktop apps, web, or group calls.

Telegram had already fixed the underlying flaw in Android version 12.10.4, released in late September 2026, so users should update to 12.10.4 or later. NebuSec reported it to Telegram on 26 September 2026, but Telegram acknowledged the report without considering it remote code execution, so no CVE was assigned and no bug bounty was paid. A separate, unrelated Telegram issue was also flagged: a flaw in the rlottie animation library, CVE-2026-111105 with a CVSS score of 7.0, that could allow code execution if a user opens a malicious file or page.

Sources: The Hacker News