A bug has been discovered in the call code of Telegram for Android, which, according to the startup NebuSec, could allow code execution on the phone of the person who answers a call. This issue was fixed in version 12.10.4, released on September 24. It affects users with Telegram for Android versions older than 12.10.4; for an attack, it is sufficient for the recipient to answer the call. Telegram was aware of the bug since August but disputes that it leads to code execution.
What to Do
Update Telegram for Android to version 12.10.4 or newer; the latest version in the client's source code is 13.1.1, released on October 25. Your current version number is visible at the bottom of the Settings screen. If you cannot update yet, you can restrict calls in Settings → Privacy and Security → Calls to My Contacts or Nobody, and avoid answering calls from unknown numbers.
According to NebuSec, there is no evidence that the bug affects iOS, desktop clients, or group calls; their testing focused on one-on-one calls on phones with ARM64 processors.
The Bug's Location
During a call, clients exchange service (signalling) messages about their status: whether the microphone and camera are on, and how the video is rotated. These messages are parsed by the tgcalls call library, which is shared across Telegram clients. In the function responsible for parsing this message, the code checked if the video rotation field existed and was a number, but then took the value from an adjacent field, the video state. If the caller sent a rotation without a video state, the client would attempt to access a dictionary element that did not exist and read its value — behavior that the C++ language does not define: the program could crash or retrieve arbitrary data from memory.
The fix involves four lines across two protocol versions, where one field name was replaced with another. In the shared tgcalls library, it appeared on April 21 under the title "Fix camera rotation," but in Telegram for Android, it was only included in 12.10.4 on September 24.
What NebuSec Claims
On October 29, NebuSec announced that the vulnerability was discovered by their product, NebuSec Code Security, which runs on a GPT-5.4 model — which they themselves call a "dinosaur." According to their data, as retold by SQ Magazine and kod.ru, versions from 8.6.2 to 12.10.3 are vulnerable, meaning those released from March 2022 to September 2026; an attacker needs a regular account and an answered call.
NebuSec's proof of code execution is a video; there is no technical analysis or CVE number, and the exploit chain has not been independently verified.
What Telegram Replied
A Telegram representative informed SQ Magazine that the company was notified of the bug in August, and the fix was released before NebuSec's report arrived. According to the representative, neither of the two reports contained a working exploit chain that led to code execution. The same response is cited by kod.ru.
