Security startup NebuSec disclosed on 29 October 2026 that a flaw in Telegram for Android allowed an attacker to run code on a phone once the victim answered a voice call. Telegram fixed it in version 12.10.4, released in late September. No CVE identifier has been assigned.

What happened

NebuSec says the bug sat in the code that handles voice and video calls and could be triggered in every Telegram for Android build from 8.6.2 through 12.10.3, a span of roughly four years. The attacker needed only an ordinary Telegram account, no prior access to the phone and no user action beyond accepting the call. Version 12.10.4 reads the rotation value from the correct field in the signalling code.

Several caveats belong in the record. NebuSec has published a demonstration video but no technical write-up, the affected phone build in that video is not shown, and The Hacker News notes that the step from the flaw to actual code execution rests on the company's claim. Telegram's Android, iOS and desktop apps share the tgcalls library, but there is no public evidence that the iOS or desktop builds were exploitable.

Who is affected

• Anyone running Telegram for Android between versions 8.6.2 and 12.10.3, which covers most installs that were not updated in the last month.
• Businesses that let staff run Telegram on the same phone as company mail, Teams or banking apps.
• Staff who sideload Telegram from outside the Play Store and therefore miss automatic updates.

What to do now

Check the Telegram version on every Android phone in the business and update to 12.10.4 or later. The version number sits at the bottom of the Settings page.

• Update through the Play Store, or push the current build through MDM if you manage handsets.
• Ask staff to decline calls from unknown accounts for the rest of this week; the flaw needed nothing more than an answered call.
• Check whether any Android phone holding company mail or MFA codes is more than a month behind on app updates.
• Treat Telegram as an unmanaged consumer channel: no client documents, no shared credentials, no second factor delivered there.

What this means for South African businesses

Telegram is common in South African SMEs as a staff and supplier channel, often on personal phones that sit outside any patching policy. That is the exposure here: not a nation-state campaign, but an unmanaged device holding work mail and one-time codes.

The practical judgement is that the likelihood of a targeted call is low and the cost of closing it is a five-minute app update, so there is no reason to leave it open.

Source: The Hacker News: Telegram Android flaw lets attackers run code when users answer voice calls.

Also on the blog

• Tailscale SSH Tailworm Flaws: Root Escalation Fixed in 1.104.4
• DreamHost forced email and FTP password resets after 23 October incident

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.