Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls
What Happened — A security researcher at NebuSec disclosed a remote‑code‑execution flaw in Telegram’s Android client. By initiating a voice call and waiting for the victim to answer, an attacker can trigger arbitrary code execution on the device. The vulnerability exists in every version prior to 12.10.4; Telegram released the fix in late September 2026 and announced the patch on October 29, 2026. No public evidence of active exploitation has been reported, but the attack requires only a regular Telegram account, making it trivially scalable.
Why It Matters for Trust & Control Assurance — The issue tests the control objective of maintaining secure configuration and timely patching of third‑party software, a single control that maps to many frameworks.
Who Is Affected — Mobile‑first enterprises, SaaS providers, and any organization that allows employees to use Telegram on Android devices.
Recommended Actions
- Verify that all Android devices run Telegram 12.10.4 or later.
- Add Telegram version checks to your mobile‑device‑management (MDM) inventory and enable automated alerts for out‑of‑date apps.
- Document the patch‑management process as evidence for audit readiness.
Technical Notes
- Attack vector: Exploitation of a code‑execution flaw triggered by answering a voice call.
- Impact: Potential full device compromise (arbitrary code execution).
- Patch: Fixed in Telegram Android 12.10.4 (released Sep 2026).
Source: The Hacker News