Affected Systems
Telegram for Android versions 8.6.2 through 12.10.3 (March 2022 to September 2026). Confirmed on ARM64-based Android devices. iOS and desktop apps not directly affected by this specific flaw. Requires victim to answer a voice call from attacker.
Exploitation Status
No evidence of active exploitation in the wild. PoC demonstrated by NebuSec on October 29, 2026. Requires chaining with two additional bugs (information leak + Android root exploit) for full device compromise. Telegram disputed RCE potential; no CVE assigned.
Business Impact
Successful exploitation grants full device control including access to messages, microphone, and camera. Attack requires user interaction (answering a voice call) and chaining multiple exploits. Flaw stems from improper handling of MediaState messages during voice calls, causing out-of-bounds memory access. Patched silently in September 2026 without CVE assignment or public acknowledgment of RCE risk.
Urgency
🟠Within 24 hours
Recommended Actions
- Update Telegram for Android to version 12.10.4 or later immediately. Verify version at bottom of Settings page.
- For users unable to update immediately, set Telegram call privacy to 'Nobody' in Settings > Privacy and Security > Calls to block incoming calls.
- Decline voice calls from unknown or untrusted Telegram contacts until update is confirmed.
- Monitor Android device logs for unexpected Telegram app behavior during voice calls, particularly crashes or memory access violations.
- Review and restrict Telegram app permissions (camera, microphone) at OS level if the app cannot be updated promptly.