A critical flaw in **Telegram for Android**, present in versions 8.6.2 through 12.10.3 (released between March 2022 and September 2026), has been identified by security startup **NebuSec**. This vulnerability, when chained with an information-leak bug and an Android root exploit, could grant an attacker complete control over a victim's phone simply by having them answer a voice call.  ### The Attack Vector **NebuSec** co-founder and CEO **Eten Zou** explained that the initial flaw allowed an escape from the Telegram app to the underlying Android operating system. By adding an Android root exploit, an attacker could then achieve full control, including access to messages, microphone, and camera. The attack specifically targets ARM64-based Android phones and requires the victim to answer the call. ### Patch and Mitigation **Telegram** addressed the core flaw in version 12.10.4 of its Android app, released in late September. Users are strongly advised to update their **Telegram for Android** application to version 12.10.4 or later immediately. The version number can be found at the bottom of the app's Settings page. While the flaw has not been observed in real-world attacks, and **NebuSec** believes they were the first to recognize its potential for remote code execution, users can further protect themselves by setting Telegram's call privacy option to "Nobody" or by simply declining calls from unknown contacts. ### Unpatched and Unrewarded **NebuSec** reported the flaw to **Telegram** on September 26, after version 12.10.4 had already shipped. Interestingly, **Telegram** acknowledged the report but did not agree that the flaw could be escalated to remote code execution. Consequently, no **CVE** identifier was assigned, and no bug bounty was paid, according to **Zou**. ### Technical Deep Dive The vulnerability resided in the code responsible for processing `MediaState` messages during a voice call. These messages convey call status, such as microphone mute status, camera activity, and video rotation. The flawed code failed to correctly handle missing fields in `MediaState` messages, leading to out-of-bounds memory access. A review of **Telegram's** published source code for version 12.10.3 confirms this. Specifically, when a `MediaState` message included a rotation value, the code would check that value but then incorrectly attempt to read a non-existent video state field. **Telegram's** version 12.10.4 corrected this by reading the rotation value from the appropriate field. The calling code that leverages this message was activated in version 8.6.2, the earliest version **NebuSec** identified as vulnerable.  ### Cross-Platform Impact and rlottie Vulnerability **Telegram's** Android, iOS, and desktop applications share a common library for calls, named `tgcalls`. A fix labeled "Fix camera rotation" was applied to `tgcalls` on April 21, 2026. While the Android app received this fix in version 12.10.4 in September, the iOS app incorporated it from version 12.7 (May) and the desktop app from version 7.0.1 (July). Whether the older code in these other platforms was exploitable remains unconfirmed. Separately, the **Zero Day Initiative (ZDI)** recently published an advisory on October 15 regarding an unpatched flaw in **rlottie**, the library used by **Telegram** apps for animated stickers. This vulnerability, tracked as **CVE-2026-111105** (CVSS score: 7.0), could allow attackers to execute code if a user opens a malicious file or page. **Telegram** reportedly informed **ZDI** in March that server-side checks mitigated this flaw, but researcher **Saifeldeen Aziz** suggests these checks can be bypassed. **Aziz's** research, utilizing AI-guided fuzzing, found memory corruption bugs in **rlottie** across all **Telegram** platforms, which could be chained with sticker delivery flaws to achieve code execution on **Telegram for iOS**. Notably, the Android app has since replaced **rlottie** with **tlottie**, a Rust-written library, between versions 12.8.1 (June) and 12.10.0 (August). The desktop app followed suit in September, and the iOS code added **tlottie** in version 13.0 in October, though it still includes **rlottie**.