NewsCompaniesFlawsGuides
Get the app

Telegram Android call flaw could help compromise a phone; fixed in version 12.10.4

From the HARD Situation Room · First reported
For everything else happening in security now, see the Situation Room.
github.com: Fix camera rotation · TelegramMessenger/tgcalls@a6ea40e
Screenshot: github.com

NebuSec says Telegram for Android versions 8.6.2 through 12.10.3 were vulnerable to code execution after an answered voice call. Full phone takeover required two additional flaws, and the researchers reported no known real attacks on 29 October. The Telegram flaw was fixed in version 12.10.4 in September.

Researchers say an answered Telegram voice call could help an attacker compromise an Android phone. The app fix is already available; check yours and your parents’ phones.

Current event. First reported . Details may change as more becomes known; updates will be added to the timeline.

What happened

If you use Telegram on an Android phone, check its version this week. Security company NebuSec disclosed an answered-call flaw on 29 October. Its announcement[1] names version 12.10.4 as the fix; Lookout’s advisory[2] also recommends that version or later.

Telegram Android call flawApp update available
HARD priority
High Check Android phones this week
Affected app versions
8.6.2 through 12.10.3
Fixed version
12.10.4 or later
Required interaction
Answering a Telegram voice call
What’s known.Version range and update advice from Lookout[2]; severity is HARD’s editorial assessment.

Timeline

  1. HARD publishes its article, at High.

Who is affected

The reported risk concerns older copies of Telegram for Android. The caller needed only an ordinary Telegram account, according to Lookout. This is a reason to check the installed app on each phone, including a parent’s phone or a handset used for work.

NebuSec had not established that iPhone apps, desktop apps or group calls were exploitable, The Hacker News reports[3].

What the demonstration establishes

NebuSec says full phone takeover needed two additional flaws. It reported no known real attacks on 29 October. Telegram doubted that code execution was possible, according to NebuSec’s account to The Hacker News; the demonstration did not identify its Telegram or Android versions.

There is a visible code correction: Telegram’s calling-library change[4] fixes how camera rotation is read. The Android source linked to the fixed release[5] contains that correction. The practical response is to install the update while the wider takeover claim remains incompletely documented.

What to do this week

  1. Update Telegram and check the number.Install the latest available update. Open Telegram’s Settings and scroll to the bottom: it should show 12.10.4 or later. Lookout recommends this check[2]. Telegram’s official Android page[6] links to Google Play and its own download.
  2. Restrict calls while arranging the update.Open Telegram’s Settings > Privacy and Security > Calls and choose Nobody for who can call you. Decline unexpected Telegram calls until you have confirmed the update.
  3. Help parents check their phones.Walk through the version check together. If someone manages your work phone, ask them to confirm the installed Telegram version too.
  • Android every Android flaw being used in attacks
  • Is Telegram safe? safe to use with care: what it collects, its record and the settings to change

References

  1. ^ NebuSec, via Nitter (). “NebuSec’s Telegram disclosure, mirrored from X”. Mirrored announcement attributes the answered-call finding to NebuSec and names fixed version 12.10.4.
  2. ^ Lookout (). “Telegram Vulnerability Advisory”. Corroborates affected and fixed versions and supplies version-check, update and call-privacy guidance.
  3. ^ The Hacker News (). “Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls”. Reports NebuSec’s claims, two additional flaws, testing limits, lack of observed attacks and account of Telegram’s response.
  4. ^ Telegram. “Fix camera rotation”. Official calling-library correction changes camera-rotation field handling; it does not substantiate the full takeover chain.
  5. ^ Telegram. “Telegram Android calling source at the reported fixed revision”. Source contains the corrected field handling; its association with version 12.10.4 comes from the reporting.
  6. ^ Telegram. “Telegram for Android”. Official download page provides direct Android and Google Play download routes.

Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.