Telegram Android Call Flaw Reportedly Enables Code Execution; Update Available

NebuSec reported a vulnerability in Telegram for Android versions 8.6.2 through 12.10.3 that could allow an attacker using an ordinary Telegram account to execute code on a victim’s phone after the victim answers a private voice call. The defect involves improper handling of missing fields in call-control MediaState messages. NebuSec demonstrated compromise on ARM64-based Android phones, and source-code review corroborated the underlying defect, but a complete technical explanation linking it to code execution was not publicly available at disclosure. No CVE identifier had been assigned, and exploitation in real-world attacks or equivalent exploitability on iOS and desktop had not been established.

Users and enterprise mobile administrators should update Telegram to version 12.10.4 or later, which fixes the flaw; the patched version was released in September 2026. MKD-CIRT also issued an advisory urging users to update. Separate reporting identified an unpatched rlottie vulnerability, CVE-2026-111105, involving malicious files or pages, and research into animated-sticker exploit chains on Telegram for iOS. Those findings are distinct from the Android voice-call flaw and do not establish that the call-based attack affects other platforms.