A flaw in Telegram for Android could be chained with two other bugs to take full control of a victim's phone through a voice call, once the victim answered, according to security startup NebuSec.
The attacker needed only an ordinary Telegram account. Telegram fixed the flaw in version 12.10.4 of the app, released in late September, and NebuSec disclosed it on October 29.
Combined with an information-leak bug, the flaw gives the attacker an escape from the Telegram app to Android, NebuSec co-founder and chief executive Eten Zou told The Hacker News. Adding an Android root exploit then gives full control of the phone, including its messages, microphone and camera.
The flaw can be triggered in every version from 8.6.2 through 12.10.3, Zou said. Those versions came out between March 2022 and September 2026.
The company confirmed it in private voice calls on ARM64-based phones and has no evidence so far that it directly affects Telegram's iOS and desktop apps or group calls.
Anyone using Telegram for Android should make sure the app is on version 12.10.4 or later. The version number appears at the bottom of the app's Settings page. The flaw had no CVE identifier as of October 29.
The attack needs the victim to be called and to answer, Zou said, so setting Telegram's call privacy option to "Nobody" blocks it, and so does declining the call.
NebuSec has not seen the flaw used in real attacks, and believes no one else had realized it could be turned into remote code execution.
NebuSec reported the flaw to Telegram on September 26, after version 12.10.4 had shipped. Telegram acknowledged the report but did not believe the flaw could be turned into remote code execution, so no CVE was assigned and no bug bounty was paid, Zou said. The Hacker News has asked Telegram for comment.
During a Telegram call, the two apps send each other short messages to set up the call and report its state. One type, called MediaState, reports whether the microphone is muted, whether the camera is on, and how the video is rotated.
The flaw was in the code that reads MediaState messages. That code did not handle missing fields correctly and accessed memory it should not, according to NebuSec.
Telegram's published source code for version 12.10.3 contains a flaw that matches that description, a review by The Hacker News found. When a MediaState message included a rotation value, the code checked that value. It then read a different field, the video state, even if the message had no such field.
Version 12.10.4 reads the rotation value from the right field. The calling code that uses this message was switched on in version 8.6.2, the first version NebuSec names.
Telegram's Android, iOS, and desktop apps use one shared library, called tgcalls, for calls. A change labeled "Fix camera rotation" made the same correction in tgcalls on April 21, 2026.
Telegram's iOS source code included that change from version 12.7, released in May, and the desktop app's code from version 7.0.1, released in July. Telegram for Android received it in version 12.10.4 in September.
Whether the earlier code could be exploited in those apps has not been shown.
NebuSec's video shows two phones, one marked as the attacker and one as the victim. The victim accepts a Telegram call. About half a minute into the call, the victim's phone switches to its home screen, the app icons fall down the screen, and a "HACKED BY NEBUSEC" logo appears.
The video does not show which Telegram or Android version the victim's phone was running. No technical write-up of the flaw was on NebuSec's website as of October 29, so the attack chain, including the two other bugs, depends on the video and on what the company says.
NebuSec, a startup backed by Y Combinator, says its Code Security product, which runs on OpenAI's GPT-5.4 model, found the flaw. In July, the company described an Android exploit chain that started with a Firefox flaw and reached the kernel of an ARM64 device running Android 17.
Separately, the Zero Day Initiative (ZDI) published an advisory on October 15 about an unpatched flaw in rlottie, the library Telegram apps have used to draw animated stickers. The flaw, tracked as CVE-2026-111105 (CVSS score: 7.0), can let an attacker run code if a user opens a malicious file or page, ZDI said.
Telegram had told ZDI in March that checks on its servers mitigated the flaw, and in April asked ZDI for a full remote code execution chain.
Those checks could be bypassed, researcher Saifeldeen Aziz says in the abstract for his OffensiveCon talk in Tokyo. The research used AI-guided fuzzing, which feeds code with large amounts of broken or unexpected input, to find memory-corruption bugs in rlottie across Telegram's iOS, Android, and desktop apps. It then chained those bugs with flaws in how stickers are delivered and checked to run code on Telegram for iOS.
The Android app replaced rlottie with tlottie, a library written in Rust, between versions 12.8.1 in June and 12.10.0 in August, according to Telegram's published source code. The desktop app's code made the same switch in September, and the iOS code added tlottie in version 13.0 in October while still including rlottie.
(This article has been updated with answers from NebuSec chief executive Eten Zou on the attack chain, how users can block the attack, and how Telegram responded to NebuSec's report. The opening now says the flaw was chained with two other bugs. A sentence describing the sticker research has also been corrected.)
