Telegram Android Flaw Allows Remote Code Execution via Call

A dangerous vulnerability in Telegram for Android allowed an attacker to run arbitrary code on a victim’s device simply by answering a voice call, according to security startup NebuSec. The attacker needed only an ordinary Telegram account, and the flaw was fixed in version 12.10.4 of the app, released in late September; NebuSec disclosed it on October 29.

The bug resides in the code that processes MediaState messages exchanged during calls, which failed to handle missing fields and accessed unintended memory. NebuSec confirmed the exploit on ARM64-based phones via private calls, but has not yet demonstrated impact on Telegram’s iOS or desktop apps.

Users of Telegram for Android should immediately update to version 12.10.4 or later, as the flaw affected all versions from 8.6.2 (March 2022) through 12.10.3. The company says its Code Security product, powered by OpenAI’s GPT-5.4 model, discovered the issue. NebuSec, a startup backed by Y Combinator, previously described an Android exploit chain starting from a Firefox flaw.

Separately, the Zero Day Initiative published an advisory on October 15 about an unpatched flaw in the rlottie library, used by Telegram for animated stickers. Tracked as CVE-2026-111105 (CVSS 7.0), the flaw can let an attacker execute code if a user opens a malicious file or page. Telegram told ZDI in March that server-side checks mitigated it, but researcher Saifeldeen Aziz claims those checks can be bypassed, as noted in his OffensiveCon talk abstract. The Android app has since replaced rlottie with tlottie, a Rust-based library, across recent versions.

✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.

Previous Articles:

• US Sanctions 10 Over North Korean Crypto IT Schemes
• Bitcoin ETFs Attract $137M, October Turns Positive
• China-linked hackers exploit PHP2Shell in Palo Alto firewalls
• CFTC Chair: AI agents could launch memecoins, raising regulatory questions
• Google’s Registered App Stores Program Enables One-Tap Installs