Telegram Android flaw let attackers run code by getting you to answer a call

It sounds ordinary: a voice call in a chat app. The unusual part is that, on affected Telegram Android versions, answering could be enough to let an attacker run code on your phone.

A voice call in a messaging app sounds routine.

People call. You answer. End of story.

But this Telegram bug was not routine at all. According to NebuSec, an attacker with nothing more than a normal Telegram account could trigger code execution on an Android phone when the target answered a voice call.

That is a serious line to cross.

Telegram says the fix is in Android version 12.10.4, released in late September. NebuSec publicly disclosed the issue on October 29. The affected range was described as every Telegram for Android version from the point given in the disclosure, but the lower bound in the facts I have is cut off, so I am not going to guess at it.

Why answering a call is such a big deal

Most people think of dangerous app behavior as something that starts with a tap on a bad link, a sketchy download, or a file you opened when you should not have.

This is different.

If the report is accurate, the action needed from the victim was simply answering a voice call in Telegram. No special attacker access. No weird enterprise setup. Just a regular account placing a call.

That changes the risk in two ways.

First, it lowers the attacker’s cost. If all they need is an account, there is less friction.

Second, it uses normal behavior against the target. Answering a call is everyday app use, not the kind of thing most people have been trained to distrust.

A useful analogy is a front door buzzer. Usually, pressing the buzzer just gets your attention. Imagine a fault where pressing it also unlocks a side door. The action looks normal, but the result is wildly out of proportion.

That is why bugs tied to call handling deserve attention. Real-time features are complicated under the hood. Audio, device permissions, codecs, networking, and app state all have to line up quickly. More moving parts usually means more room for mistakes.

“Run code” is the part people should focus on

“Run code” means the attacker may be able to make the app or device process data in a way the attacker controls. The exact impact can vary from bug to bug, but remote code execution is one of the more serious classes of software flaw because it can turn a message, file, or call into a path for taking action on the target device.

That does not automatically mean full phone takeover in every case. Real attacks depend on a lot of details, including app sandboxing, Android protections, and what exactly the attacker could execute.

Still, this is not a minor crash bug.

If a flaw lets outside input cross the line into code execution, that is the kind of issue you patch first and ask questions later.

Another detail worth paying attention to is the timing. The fix landed in version 12.10.4 in late September, and public disclosure came on October 29. That gap is normal enough in security: patch first, then discuss publicly once users have a chance to update.

What I would do if Telegram is on an Android phone you care about

If you use Telegram on Android, the practical move is simple:

• Check the app version and update to at least 12.10.4.
• Turn on automatic app updates if you usually leave them off.
• If an update is not available yet through your store, keep checking and avoid answering unexpected Telegram voice calls in the meantime.
• Be more cautious with calls from accounts you do not recognize, even inside apps that feel familiar.
• Update Android itself too. App bugs and OS defenses work together, and newer Android versions often make exploitation harder.

For families or small teams, this is also a good reminder to check the boring basics. A lot of risk reduction is not glamorous. It is making sure the software people rely on every day is actually current.

Routine is where attackers like to hide.

The main point is simple: if a chat app bug turns answering a call into a code execution path, patch speed matters more than perfect understanding of the internals. If Telegram on Android is not updated to version 12.10.4 or later, fix that first.