Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls
Our summary
Security startup NebuSec found a memory-handling bug in Telegram's Android app that let an attacker execute code on a victim's device simply by having them answer a voice call, with no special privileges needed beyond a regular Telegram account. The issue affected every version from 8.6.2 through 12.10.3 (released between March 2022 and September 2026) and stemmed from faulty parsing of call-setup "MediaState" messages in the shared tgcalls library, which misread a video-state field even when it was absent, corrupting memory. Telegram patched the flaw in version 12.10.4, released in late September, though no CVE number had been assigned as of October 29, and it's unclear whether iOS, desktop, or group calls share the same exposure. Separately, ZDI disclosed an unrelated, still-unpatched flaw in the rlottie sticker-rendering library (CVE-2026-111105, CVSS 7.0) that could enable code execution via malicious stickers, though Telegram's Android, desktop, and newer iOS builds have already migrated away from rlottie to the Rust-based tlottie library.
The Hacker News publishes this story on its own site; we link to it rather than reprint it.
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.