As reported by The Hacker News, a vulnerability in Telegram for Android allowed remote code execution when a victim answered a voice call from an attacker using nothing more than a standard Telegram account. Security firm NebuSec disclosed the flaw on October 29, 2026, after Telegram patched it in version 12.10.4, released in late September.
The vulnerability is a textbook example of how a single memory safety error in a shared library can create a massive attack surface across an entire ecosystem. The flaw resides in the tgcalls library — the shared call-handling code used by Telegram's Android, iOS, and desktop clients. When processing a MediaState message during call setup, the Android client read a video state field without verifying its presence, resulting in an out-of-bounds memory access. An attacker could craft a malicious MediaState message to manipulate this behavior and achieve code execution.
Vulnerability Details
| Field | Details |
|---|---|
| CVE Identifier | Not yet assigned as of October 29, 2026 |
| Severity | High to Critical (RCE via minimal user interaction — answering a call) |
| Affected Product | Telegram for Android |
| Affected Versions | 8.6.2 through 12.10.3 (March 2022 – September 2026) |
| Patched Version | 12.10.4 (released late September 2026) |
| Root Cause | Missing field validation in MediaState message parsing within tgcalls library |
| Exploitation Trigger | Victim answers a voice call from attacker's Telegram account |
| Active Exploitation | No confirmed in-the-wild exploitation reported |
| Other Platforms | iOS (fixed in v12.7, May 2026) and Desktop (fixed in v7.0.1, July 2026) received the tgcalls fix earlier; exploitability on those platforms unconfirmed |
Why This Matters
The attack vector is alarmingly low-friction. Unlike most mobile RCE vulnerabilities that require clicking a malicious link, downloading a file, or visiting a compromised webpage, this flaw is triggered by a routine action — answering a phone call. The attacker needs only a free Telegram account and the victim's phone number or username. There is no spearphishing email to spot, no suspicious attachment to avoid, no link to resist. Social engineering is reduced to simply getting someone to pick up.
The four-and-a-half-year window of exposure — from March 2022 to September 2026 — makes this one of the longest-lived remotely exploitable vulnerabilities in a major messaging platform in recent memory.
Telegram is used by over 900 million monthly active users, including journalists, activists, government officials, and enterprise employees who use it for informal or even semi-official communications. The demographic overlap between high-value targets and Telegram's user base makes this vulnerability particularly attractive to nation-state actors and mercenary spyware vendors. The fact that exploitation requires only a standard account means attribution and detection are inherently difficult — the attacker's traffic looks like an ordinary call.
Broader Implications: The Shared Library Problem
The tgcalls library timeline reveals a concerning patching disparity. The fix labeled "Fix camera rotation" was committed to tgcalls on April 21, 2026. iOS incorporated it in May, desktop in July, but Android didn't receive it until September — a four-month gap between platforms. This illustrates a systemic problem: when a shared library underpins multiple clients, inconsistent release cadences create windows where knowledge of a fix in one platform can be reverse-engineered to exploit another. Threat actors monitor open-source repositories for exactly these kinds of commits.
Additionally, the vulnerability underscores the persistent danger of memory-unsafe code in real-time communications libraries. MediaState parsing involves deserializing untrusted, peer-controlled data — a scenario where memory-safe languages or rigorous bounds checking are non-negotiable. The field confusion between rotation and video state is the type of bug that memory-safe paradigms would eliminate by construction.
Who Is at Risk
Shield53 Recommendations
Immediate Actions
- Update Telegram for Android immediately to version 12.10.4 or later. Verify the version in Settings (scroll to bottom of the Settings page).
- Check for auto-update settings: Ensure Google Play Store auto-updates are enabled for Telegram. For sideloaded installations (common in regions where Play Store is restricted), manually download the latest APK from Telegram's official website.
- Audit managed device fleets: MDM administrators should verify Telegram version compliance across all enrolled Android devices and push update policies where applicable.
- Brief high-risk users: Inform journalists, executives, and other high-value personnel about the vulnerability and the importance of not answering calls from unknown Telegram accounts until updated.
Detection & Hardening
- Monitor for anomalous app behavior following Telegram calls — unexpected app launches, screen transitions, or background process activity may indicate exploitation.
- Review Telegram call logs for unusual incoming calls from unknown accounts in the weeks preceding October 29, 2026, particularly if device anomalies were observed.
- Implement mobile threat defense (MTD) solutions that can detect post-exploitation behavior on Android devices, as the initial call itself will appear legitimate.
- Restrict Telegram on corporate-managed devices where feasible, or enforce app version minimums through MDM configuration profiles.
Strategic Considerations
- Reassess Telegram as an approved communication channel for sensitive organizational discussions until a formal risk assessment accounts for this vulnerability's exposure window.
- Advocate for memory-safe rewrites of critical parsing libraries in messaging platforms your organization depends on — this class of bug is preventable.
- Track CVE assignment once published and add to internal vulnerability management tracking with appropriate SLAs for mobile patching.
