Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls

A remote code execution vulnerability was discovered in Telegram for Android by security startup NebuSec. The flaw allows an attacker with only an ordinary Telegram account to execute arbitrary code on a victim's device simply by having the victim answer a voice call. The vulnerability affects all versions of Telegram for Android prior to 12.10.4. Telegram patched the issue in version 12.10.4, released in late September 2026. NebuSec publicly disclosed the vulnerability on October 29, 2026. The attack requires minimal user interaction, making it particularly dangerous as victims only need to answer a call.