A security flaw in Telegram for Android allowed attackers to run code on a victim's phone when the victim answered a voice call, according to a report by security startup NebuSec.
The vulnerability or weakness
The vulnerability was in the code that reads MediaState messages, specifically in the way it handled missing fields, leading to memory access issues.
Earlier attacks and coverage
- Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers (2026-10-28)
- Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens (2026-10-27)
- PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw (2026-10-26)
- uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts (2026-10-26)
- OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL (2026-10-22)
Business impact
Organizations using Telegram for Android may face risks to their operations and data security, as the flaw could be exploited to execute malicious code.
Industries affected
This issue affects organizations in various sectors, particularly those that rely heavily on mobile communication and may use Telegram for internal communications.
Users affected
Users of Telegram for Android are advised to update to version 12.10.4 or later to mitigate the risk of code execution attacks via voice calls.
