Security startup NebuSec says a flaw in Telegram for Android allowed an attacker with an ordinary Telegram account to run code on a victim's phone via a voice call once the victim answered, according to The Hacker News, which reported on 29 October 2026 that NebuSec disclosed the flaw that day.

According to The Hacker News, NebuSec says every version from 8.6.2 through 12.10.3 is affected, Telegram fixed the flaw in version 12.10.4, released in late September, and NebuSec confirmed it in private calls on ARM64-based phones and has no evidence so far that it directly affects Telegram's iOS and desktop apps or group calls.

The Hacker News says the flaw sits in the code that reads MediaState call-signalling messages, which NebuSec says did not handle missing fields correctly and accessed memory it should not; The Hacker News says its own review of Telegram's published source code found a matching flaw in 12.10.3 that version 12.10.4 corrects.

The Hacker News says no technical write-up was on NebuSec's website as of 29 October, so the step from the flaw to running code rests on NebuSec's video and statements, and that the flaw had no CVE identifier. (source: The Hacker News)