Telegram Android Voice Call Flaw Enables Remote Code Execution
A critical memory corruption bug in Telegram for Android allows attackers to execute unauthorized code.
1Critical Android Voice Vulnerability
A security flaw in Telegram for Android allowed attackers to execute code on victim devices during voice calls. Discovered by NebuSec, the vulnerability affected versions 8.6.2 through 12.10.3. Users are urged to update to version 12.10.4 immediately, as this patch corrects the memory access error identified within the application's call processing logic.
2Technical Root Cause Analysis
The vulnerability originated in the MediaState message handling code, which manages call parameters like microphone status and camera rotation. The application incorrectly accessed memory when processing missing fields in these messages. Telegram addressed this by ensuring the rotation value is read from the correct field, preventing unauthorized memory access during active voice sessions.
3Scope and Platform Impact
NebuSec confirmed the exploit on ARM64-based Android devices. While Telegram shares the tgcalls library across iOS, desktop, and Android, evidence of exploitability on non-Android platforms remains unproven. The fix was applied to the shared library on April 21, 2026, but only reached the Android application in the September 12.10.4 release.
4Demonstration of Exploit Capability
NebuSec provided a video demonstration showing a victim's phone compromised after answering a call. The device displayed a 'HACKED BY NEBUSEC' logo, confirming the ability to manipulate the user interface. Although the specific Android version used in the test was not disclosed, the demonstration highlights the potential severity of the memory corruption flaw.
5AI-Driven Vulnerability Discovery
NebuSec utilized its Code Security product, powered by OpenAI's GPT-5.4 model, to identify this specific Telegram vulnerability. This startup, backed by Y Combinator, previously documented complex exploit chains involving Firefox and Android kernel access. Their methodology underscores the growing role of AI-assisted tools in discovering deep-seated memory corruption bugs within complex mobile applications.
6Parallel Risks in Sticker Libraries
Beyond the voice call flaw, Telegram faces scrutiny regarding its rlottie library, used for animated stickers. The Zero Day Initiative reported a separate vulnerability, CVE-2026-111105, with a CVSS score of 7.0. While Telegram attempted server-side mitigations, researchers demonstrated that these checks could be bypassed using AI-guided fuzzing techniques to chain memory corruption bugs.
7Transition to Rust-Based Security
In response to ongoing security challenges, Telegram has migrated its Android and desktop applications from rlottie to tlottie, a library written in Rust. This transition occurred between June and September 2026. The iOS version began integrating tlottie in October, signaling a strategic shift toward memory-safe programming languages to mitigate future vulnerabilities in sticker rendering.
8Security Implications for Users
The absence of a CVE identifier for the voice call flaw as of October 29 highlights the rapid nature of these disclosures. Users must verify their app version via the Settings page to ensure protection. This incident reinforces the necessity of maintaining updated software to defend against evolving remote code execution attack vectors.
Original article: The Hacker News — Telegram Android Voice Call Flaw Enables Remote Code Execution