Telegram Android flaw let attackers run code via voice calls, fixed in 12.10.4
Users on Android should confirm they run version 12.10.4 or later, as the flaw is confirmed only on ARM64 phones and iOS and desktop exposure has not been ruled out.
A flaw in Telegram's Android app could let an attacker with an ordinary Telegram account run code on a victim's phone once the victim answered a voice call, according to security startup NebuSec. Telegram patched it in version 12.10.4, released in late September, and NebuSec disclosed it on October 29; NebuSec says every version from 8.6.2 through 12.10.3 is affected and has confirmed it only on ARM64 phones. A review of Telegram's published 12.10.3 code found a mishandled MediaState message that reads the wrong field when a rotation value is present, and the same correction appeared in the shared tgcalls library in April, which reached the iOS and desktop code earlier but has not been shown to be exploitable there. NebuSec's video demonstrates the attack, but no technical write-up was on its website as of October 29, and whether the flaw was used in real attacks remains unanswered. Users should confirm they are on version 12.10.4 or later, shown at the bottom of the Settings page.
Why it matters
The flaw means anyone with an ordinary Telegram account could, in principle, reach code execution on a target's Android phone just by placing a voice call that the target answers, without any further action from the victim. Because the fix is a software update, the main change is for users who have not yet installed it: they remain exposed until they do. The same correction also reached Telegram's shared tgcalls library months earlier, so the question of whether other Telegram apps were affected is still open rather than settled, and it is not yet known whether the flaw was used in real attacks.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.