A bug in Telegram for Android let an attacker run code on a phone once its owner answered a voice call, according to the security startup NebuSec, which disclosed the flaw on 29 October 2026. Telegram fixed it in version 12.10.4, released in late September, but the affected range is wide: versions 8.6.2 through 12.10.3, shipped between March 2022 and September 2026. The attacker needed nothing more than an ordinary Telegram account.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
In a demonstration video, NebuSec shows the victim’s phone dropping to the home screen and displaying a “HACKED BY NEBUSEC” logo after the call is picked up. The firm has not yet released a technical write-up, and the public record does not say whether anyone used the flaw against real targets. NebuSec confirmed the attack on ARM64 phones in private calls and has seen no evidence so far that iOS, desktop or group calls are affected.
A mistyped field in call signaling code
The Hacker News describes the fault as sitting in the code that reads MediaState messages, which report a caller’s mute status, camera state and video rotation. The code did not cope with fields that were missing, so it read memory it should not have touched. Telegram’s published source for version 12.10.3 shows the rotation check reading the wrong field: it tested the video state value where it should have tested the video rotation value, as seen in the call signaling source file in the Android repository.
Telegram’s own repository carries the repair. A commit titled Fix camera rotation, authored by a developer listed as isaac, changes two files by four lines each so that each of the four rotation checks, for 0, 90, 180 and 270 degrees, reads the rotation value instead of the video state. The Hacker News dates the change to 21 April 2026.
Five months from fix to Android release
That April change reached other platforms first. The Hacker News reports it arrived in Telegram for iOS in version 12.7 in May and in the desktop app in version 7.0.1 in July, while Android did not receive it until 12.10.4 in September. A phone running any Android build older than 12.10.4 therefore sat inside the range NebuSec describes for months after the corrected code existed. No CVE had been assigned as of 29 October.
NebuSec’s earlier work gives some context for the claim. In July, The Hacker News reports, the firm described an Android exploit chain that started with a Firefox flaw and reached the kernel of an ARM64 device running Android 17. The Y Combinator listing names four founders: Eten Zou as chief executive, Yuan Tan as chief technology officer, Frank Wu as chief operating officer and Xiaochuan Yu as vice president of vulnerability research. It describes a product called VEGA that finds bugs in a codebase and generates proofs of concept, and lists claims such as more than $400,000 in bug bounties that are the company’s own statements.
NebuSec is a San Francisco company in Y Combinator’s Summer 2026 batch, and its Y Combinator profile names Eten Zou as chief executive. NebuSec says its AI-driven code security tooling found the call flaw. Telegram has made no direct public statement about it that The Hacker News could cite.
A separate sticker-library flaw is still unpatched
Researchers have flagged a second Telegram problem that should not be confused with the call bug. Zero Day Initiative advisory ZDI-26-757, published on 15 October 2026, covers CVE-2026-111105, a code-execution flaw in the rlottie animation library rated 7.0 on the CVSS scale, credited to Michael DePlante of the Zero Day Initiative. Zero Day Initiative reported it on 26 March. Telegram replied on 31 March that server-side validation mitigates it, and on 14 April asked for a complete remote code execution chain. The advisory records no confirmation of a fix.
The rlottie work comes from Saifeldeen Aziz, a separate researcher who will present findings on the library at OffensiveCon in Tokyo. Aziz says AI-guided fuzzing found memory-corruption bugs in rlottie across Telegram’s iOS, Android and desktop apps, traced to how stickers are delivered and checked, and that he chained them to run code on Telegram for iOS while getting around server-side checks. The advisory’s timeline adds that the Zero Day Initiative told Telegram on 30 July it meant to publish the case as a zero-day advisory, and that it considers a demand for a full exploit chain at odds with standard coordinated disclosure practice.
Telegram’s apps are moving from rlottie to a Rust replacement called tlottie: Android made the switch between versions 12.8.1 and 12.10.0, desktop in September, and iOS added tlottie in version 13.0 in October while still shipping rlottie, The Hacker News reports. Whether NebuSec’s call flaw was exploited before 12.10.4 reached phones remains the open question, and NebuSec, the firm that disclosed it, has so far offered a demonstration rather than evidence either way.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- NOAA now gives this winter a 75% chance of the strongest El Nino since 1950
- Doctors warn a silent liver disease now affects one in three American adults
- The FBI told the rest of ShinyHunters to surrender after a 24-year-old was arrested
- Two passengers died at an Ohio toll plaza, and the NTSB now wants the cash lanes shut
