Critical Remote Code Execution Vulnerability in Telegram for Android Disclosed

A remote code execution vulnerability in Telegram for Android was reported by the security startup NebuSec and subsequently covered by The Hacker News. The flaw could be exploited when an attacker, using a normal Telegram account, placed a voice call to a target. The malicious code execution occurred automatically when the victim answered the call, without requiring any further user interaction.

Telegram addressed the issue by releasing version 12.10.4 in late September 2026. NebuSec disclosed the vulnerability on October 29, 2026. The report indicates that all Telegram Android versions prior to 12.10.4 were affected. The exact starting version for the flaw was not fully specified in the available summary.

The vulnerability highlights the importance of maintaining updated messaging applications, as voice call features can present unexpected attack surfaces. Users are advised to ensure their Telegram Android application is updated to the latest version to mitigate the risk.