A flaw let one answered Telegram call run code on your phone. Update the app on your Android phone

A security research company called NebuSec published a flaw in Telegram for Android on October 29, 2026.

The flaw was in the code that reads short status messages during a voice call.

Those messages carry small call details, for example whether the camera is on and how the video is turned.

The code read one of those details from the wrong place. With the right message, the app was able to run the attacker's instructions.

An attacker needed only an ordinary Telegram account. The attack started when the victim answered the attacker's call.

Versions 8.6.2 through 12.10.3 carried the flaw. Telegram released those versions between March 2022 and September 2026.

Telegram fixed the code in version 12.10.4, released in late September 2026.

The Hacker News checked the source code that Telegram publishes and found the matching fault in version 12.10.3.

We checked the two code versions as well. The old code read a call detail from the wrong message field. The new code reads it from the right one.

NebuSec showed the attack in a video. About half a minute after the call starts, the phone leaves the call and shows a “HACKED BY NEBUSEC” sign.

Full control of the phone needed two more bugs. One bug moves the attacker out of the Telegram app. The other gives control of Android itself.

NebuSec reported the flaw to Telegram on September 26, 2026. Telegram answered the report. The company did not accept that the flaw allows code to run.

So the flaw received no CVE number, the public ID that companies give to confirmed flaws.

This report concerns people who use Telegram on an Android phone.

The attack worked during private calls between two people. Group calls were not part of the tests.

The tests ran on phones with ARM64 processors. Nearly all Android phones from the last ten years use this kind of processor.

NebuSec has no evidence that the iPhone or computer versions of Telegram can be attacked this way.

All three versions of Telegram share the same call code. That shared code also received a similar fix.

An attacker who runs code on your phone can read your messages and reach the microphone and camera. The two extra bugs made that possible.

NebuSec published no written details of the flaw by November 2, 2026. The claim about running code rests on the video and the company's statements.

The video does not show which Telegram or Android version the test phone ran.

NebuSec says it saw no real attack on a person. We do not know whether someone used this flaw before the fix.

We do not know how many Telegram users still run version 12.10.3 or an older number.

The iPhone and computer apps share the Android call code. Whether someone can attack their older versions this way has not been shown.