Imagine your phone rings on Telegram. So you tap “Answer”, like you do every day. Then, thirty seconds later, your screen is showing a message from a hacker. Sounds like a movie, right? But security researchers say this was possible on Telegram for Android until a recent update. In short, this is the Telegram Android flaw in simple words, and what you can do about it.
On 29 October 2026, a security startup called NebuSec disclosed a serious bug in Telegram’s Android app. In fact, it sat in the voice call code for more than four years. Still, the good news is that Telegram has already fixed it. The bad news: if your app is not updated, you may still be at risk.
So, let’s break it down in simple words.
What exactly happened in the Telegram Android flaw?
However, NebuSec, a startup backed by Y Combinator, found a memory bug in the part of Telegram that handles one-to-one voice and video calls on Android. As a result, according to the company, an attacker could use this bug to run their own code on the victim’s phone, just by calling and getting the victim to answer.
Also, NebuSec shared a short demo video. In it, a victim accepts a call, and after about 30 seconds the phone jumps to the home screen and shows a “HACKED BY NEBUSEC” logo. Also, NebuSec says its own AI-powered code scanning product found the bug. In addition, it reportedly runs on OpenAI’s GPT-5.4 model.
In fact, the attacker did not need any special access. In fact, a normal Telegram account was enough to place the call.
Which Telegram versions are affected?
- Affected: Telegram for Android versions 8.6.2 to 12.10.3 (released between March 2022 and September 2026).
- Fixed: Version 12.10.4, released in late September 2026.
- Tested on: ARM64 phones (which covers most modern Android phones), in private calls.
- Not shown so far: NebuSec says it has no evidence that iPhone, desktop or group calls are directly affected.
Meanwhile, as of 29 October 2026, the flaw had no CVE number, and researchers had not publicly reported any real attacks.
How does the Telegram Android flaw work? (Simple explanation)
When two people are on a Telegram call, the two apps keep sending small “status” messages to each other in the background. For example, Telegram calls one such message MediaState. It tells the other phone things like:
- Is the microphone muted?
- Is the camera on or off?
- Which way is the video rotated (0, 90, 180 or 270 degrees)?
Think of it like a form with a few boxes. However, the app’s code should have read the “rotation” box. But because of a small coding mistake, it read a different box instead, even when that box was empty. As a result, reading something that isn’t there makes the program touch memory it should never touch.
For an ordinary user, this kind of mistake might only crash the app. But a skilled attacker can send a carefully crafted message that turns this memory mistake into a way to run their own code. In short, that is what security people call Remote Code Execution (RCE), one of the most dangerous types of bugs.
Interestingly, the fix itself was tiny. Then, the shared calling library (called tgcalls) reportedly received a correction labeled “Fix camera rotation” in April 2026. In fact, that change pointed the code to the correct field. Meanwhile, Telegram for iOS got it in version 12.7 (May 2026) and Telegram Desktop in version 7.0.1 (July 2026). Android got it in 12.10.4. Overall, one small line of code made a big difference.
Why Indian users should care about the Telegram Android flaw
India is one of Telegram’s biggest markets. For example, students use it for study groups and exam notes. Also, professionals use it for work chats and trading or job channels. Many of us also have older Android phones where apps are not updated automatically.
A bug that only needs you to answer a call is worrying because answering calls is normal behaviour. In fact, you do not have to click a strange link or install a fake APK. That is why updating matters so much here.
The bigger story: AI is now finding bugs
This case is also part of a larger trend in 2026. Overall, AI-powered tools now find more and more serious bugs, not only human researchers. That is good when defenders find bugs first. But it also means attackers may find bugs faster too. The time between a fix and a working attack is getting shorter, so quick updates are more important than ever.
Separately, researchers reportedly discussed a different Telegram issue in an animation library called rlottie in October 2026. Also, Telegram’s Android app has reportedly moved to a newer Rust-based library. This is a separate issue, but it shows why messaging apps are a popular target for researchers.
What should you do about the Telegram Android flaw?
- Update Telegram now. First, open Google Play Store, search Telegram and tap Update. Make sure you are on version 12.10.4 or newer.
- Check your version. In Telegram, go to Settings and scroll to the bottom. The version number is shown there.
- Limit who can call you. Go to Settings → Privacy and Security → Calls, and set “Who can call me” to “My Contacts”. This reduces calls from strangers.
- Turn on auto-update. In Play Store, enable auto-update for important apps like Telegram, WhatsApp and banking apps.
- Download only from official stores. Avoid “modded” or old Telegram APKs from random websites. They may never get this fix.
- For companies: If staff use Telegram on work phones, push the update through your mobile device management (MDM) tool and check versions.
Key takeaways on the Telegram Android flaw
- A memory bug in Telegram for Android’s call code could reportedly let attackers run code when a victim answers a call.
- Versions 8.6.2 to 12.10.3 are affected; 12.10.4 fixes it.
- No real-world attacks had been reported as of 29 October 2026.
- An AI-powered code scanning tool found the bug, showing how fast bug hunting is changing.
- Updating your app is the simplest and best protection.
FAQ
Do I need to click anything for this attack to work? According to NebuSec, the victim only had to answer a voice call. The attacker needed no link or file.
Want more everyday security habits? Read our guide on WPSplinter Wi-Fi Vulnerability: Hackers May Take Control of Routers Without Your Password.
Is Telegram on iPhone affected? NebuSec says it has no evidence that the bug directly affects iOS. The related fix also reached iOS in version 12.7 in May 2026, so keep iPhone apps updated too.
Has any attacker used this bug to hack someone? Nobody had publicly reported real-world attacks as of 29 October 2026.
Does this bug have a CVE number? Not as of 29 October 2026, according to public reports.
Should I stop using Telegram? No need to panic. Just update to version 12.10.4 or later and limit calls to your contacts.
GK Practice Questions
Test your understanding of this cybersecurity news with these practice questions.
Section A: Multiple Choice Questions (MCQs)
Section B: Short Answer Questions
Section C: Descriptive / Mains Questions
Answer Key
- b) NebuSec
- c) 12.10.4
- a) Remote Code Execution
- c) MediaState
- c) Answer a voice call
- a) tgcalls
- 8.6.2 to 12.10.3 (released between March 2022 and September 2026).
- 29 October 2026.
- An AI-powered code security tool built by NebuSec, reportedly running on OpenAI’s GPT-5.4.
- Settings → Privacy and Security → Calls, set “Who can call me” to “My Contacts”.
- Common Vulnerabilities and Exposures: a public ID system for known security flaws.
For descriptive questions, cover the basic concept, the real example, the impact on users, and practical solutions such as quick updates, secure coding and responsible disclosure.
