Telegram Android Flaw Exposes Users to Remote Attacks

A serious security vulnerability in Telegram's Android application allowed attackers to execute malicious code on users' smartphones simply by getting them to answer a voice call. Discovered by cybersecurity startup NebuSec, the flaw raises concerns about mobile communication security.

The vulnerability affected Telegram Android versions 8.6.2 through 12.10.3, released between March 2022 and September 2026. Attackers required only a standard Telegram account, making exploitation potentially accessible without privileged access.

Researchers identified the weakness in Telegram's MediaState processing mechanism, which manages microphone, camera and video rotation information during calls. Improper handling of missing data fields triggered unauthorized memory access, creating opportunities for remote code execution.

NebuSec demonstrated the exploit on ARM64-based Android smartphones during private voice calls. However, researchers have not confirmed whether attackers exploited the vulnerability in real-world incidents or established the full extent of potential device compromise.

Telegram addressed the issue in Android version 12.10.4, released in September 2026. Users are strongly advised to update immediately. No confirmed evidence currently suggests equivalent exploitation affecting iOS, desktop applications or group calls.

Separately, researchers highlighted another Telegram vulnerability involving the rlottie animation library, tracked as CVE-2026-111105. The discovery underscores growing security risks associated with third-party components and multimedia processing technologies.

The larger concern extends beyond Telegram. As communication platforms become essential for business and personal interactions, vulnerabilities can transform routine calls into potential attack vectors. Enterprises must prioritize application patching, continuous vulnerability assessments and mobile threat monitoring to safeguard digital identities and sensitive information.