Telegram for Android RCE via answering a voice call (versions 8.6.2–12.10.3) disclosed by NebuSec, fixed in 12.10.4
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 30/10/2026 00:04; os links antigos trazem para cá.
Security startup NebuSec disclosed on October 29, 2026 a remote code execution flaw in Telegram for Android. An attacker with only an ordinary Telegram account can execute code on a victim's device once the victim answers a voice call (thehackernews.com, olhardigital.com.br). All versions from 8.6.2 through 12.10.3 (March 2022 to September 2026) are affected. NebuSec confirmed the issue in private one-to-one calls on ARM64 phones. Telegram fixed it in version 12.10.4, released in late September (thehackernews.com). As of October 29 no CVE had been assigned, and it is unclear whether the flaw was exploited in the wild (olhardigital.com.br). NebuSec has not published a technical write-up, so the step from memory corruption to code execution rests on its demo video (thehackernews.com). A separate, unpatched rlottie flaw, CVE-2026-111105, was published by ZDI and is a distinct issue.
Entenda a falha
A vulnerabilidade
Remote code execution in Telegram for Android, in the code that reads MediaState messages during voice calls. The attacker needs only an ordinary Telegram account and the victim has to answer a private one-to-one call. The result is code execution on the phone. NebuSec confirmed it on ARM64 devices. Versions 8.6.2 through 12.10.3 (March 2022 to September 2026) are affected and 12.10.4 fixes it. The flaw had no CVE as of October 29. CVE-2026-111105, listed with the story, is a separate unpatched rlottie bug published by ZDI. No direct impact has been shown on iOS, desktop or group calls.
Como funciona
During a call, the two apps exchange short messages to set it up and report its state. One type, MediaState, says whether the microphone is muted, whether the camera is on and how the video is rotated. When the victim's app receives one with a rotation value, it checks that value. It then reads a different field, the video state, even if the message does not contain it. That read of a missing field accesses memory it should not and is where it goes wrong. NebuSec's video shows this leading to code execution, but it has published no write-up of the step from memory corruption to code execution.
Por que é vulnerável
The root cause is missing-field handling when parsing MediaState: the code validates the rotation value but then reads the video-state field without confirming it exists, causing an improper memory access. The Hacker News matched this description to Telegram's published 12.10.3 source. The articles do not say why it went unnoticed for over four years; the call code using this message was enabled in 8.6.2. The fix in 12.10.4 reads the rotation value from the correct field. The same correction, labeled "Fix camera rotation", landed in the shared tgcalls library on April 21, 2026, and reached iOS and desktop before Android.
Onde está
The code that parses MediaState messages in Telegram's call stack (the shared tgcalls library), fixed by the "Fix camera rotation" change of April 21, 2026; the articles name no file or function.
Como foi descoberta
NebuSec, a Y Combinator-backed startup, says its Code Security product, running on OpenAI GPT-5.4, found the flaw. It disclosed it on October 29, 2026, after Telegram shipped 12.10.4 in late September. The articles do not say when or how it was reported to Telegram, or whether disclosure was coordinated. The Hacker News checked Telegram's public source and found code matching the description. It asked Telegram and NebuSec whether the flaw was exploited in the wild; no exploitation has been reported.
PoC pública
NebuSec published a video, not exploit code. Two phones appear, attacker and victim; after the victim accepts a call, about half a minute later the victim's phone goes to the home screen and shows a "HACKED BY NEBUSEC" logo. The video does not show the Telegram or Android version, and there is no technical write-up or public repository, so the jump from the bug to code execution rests on the video and the company's word. Since the exploit evidently exists and the flaw needs only a call to be answered, update to 12.10.4 without delay.
Explicação gerada por IA a partir da matéria e dos artigos, em 30/10/2026 00:19.
Detalhes técnicos
- During a Telegram call, peers exchange MediaState messages reporting microphone mute, camera state and video rotation. The parser mishandled missing fields and accessed memory it should not. When a rotation value was present, the code checked it and then read the video-state field even if that field was absent (thehackernews.com).
- The call code using this message was enabled in 8.6.2. Version 12.10.4 reads rotation from the correct field (thehackernews.com).
- The shared tgcalls library received the equivalent "Fix camera rotation" change on April 21, 2026. It reached iOS 12.7 (May) and desktop 7.0.1 (July) before Android (thehackernews.com).
- NebuSec published a video in which Telegram crashes on an ARM64 handset and the home screen shows the string "HACKED BY NEBUSEC" (olhardigital.com.br).
- NebuSec attributes discovery to its Code Security product running on OpenAI GPT-5.4 (thehackernews.com). It describes the research as assisted by an LLM-based code security pipeline (olhardigital.com.br).
- Separate rlottie issue: ZDI published an advisory on October 15 for CVE-2026-111105 (CVSS 7.0), an unpatched flaw in the animated-sticker library historically used by Telegram apps (thehackernews.com).
- Researcher Saifeldeen Aziz reports that Telegram's server-side checks mitigating the rlottie bug could be bypassed. He says AI-guided-fuzzing-found memory-corruption bugs could be chained into code execution on Telegram for iOS (thehackernews.com).
- Android swapped rlottie for the Rust-based tlottie between 12.8.1 and 12.10.0, and desktop did so in September. iOS added tlottie in 13.0 while retaining rlottie (thehackernews.com).
Remediação
- Update Telegram for Android to 12.10.4 or later. The installed version is shown at the bottom of the Settings screen (thehackernews.com, olhardigital.com.br).
- On unpatched devices, treat unsolicited voice calls from unknown accounts with caution (thehackernews.com).
Relatos divergentes
- Other platforms: olhardigital.com.br says no direct impact was observed on iOS, desktop clients or group calls, because the fix had already been merged into those codebases before Android. thehackernews.com is more cautious: the fix reached iOS and desktop earlier, but exploitability in those apps is unshown. Neither source confirms impact outside Android private calls on ARM64.
- Bug description: olhardigital.com.br describes generic signaling messages missing expected fields. thehackernews.com, the more detailed and more recent in technical content, pins it to the MediaState rotation/video-state handling.
- In-the-wild exploitation: olhardigital.com.br says this is unclear. thehackernews.com does not report any exploitation.
Linha do tempo
-
Telegram for Android RCE triggered by answering a voice call, fixed in 12.10.4
ler a análise desta fonte ocultar
Security firm NebuSec disclosed a remote code execution vulnerability in Telegram for Android that could be triggered when a victim simply answered an incoming voice call. The flaw affected versions 8.6.2 through 12.10.3 (March 2022 to September 2026) and was fixed in version 12.10.4. Exploitation required only a regular Telegram account, and the issue was confirmed on devices with ARM64 processors in private (one-to-one) calls. No direct impact was observed on iOS, desktop clients or group calls, as the fix had already been merged into those codebases before reaching Android. As of 29 October 2026 the vulnerability had no assigned CVE identifier, and it is unclear whether it was exploited in the wild.
Technical Details
The bug lay in the parsing of signaling messages used to set up and report voice call state. When such a message lacked some of the expected fields, the code performed an improper memory access, leading to code execution. NebuSec published a video demonstration in which Telegram crashes on an ARM64 handset and the home screen displays the string "HACKED BY NEBUSEC". The company stated the research was assisted by an LLM-based code security pipeline.
Remediation
Update Telegram for Android to 12.10.4 or later. Users can verify the installed build number at the bottom of the Telegram settings screen.
-
Telegram for Android RCE triggered by answering a voice call, fixed in 12.10.4
ler a análise desta fonte ocultar
Security startup NebuSec disclosed on October 29 a flaw in Telegram for Android that allows an attacker holding only an ordinary Telegram account to execute code on a victim's device once the victim answers a voice call. The company says every version from 8.6.2 through 12.10.3 (March 2022 to September 2026) is affected, and that it confirmed the issue in private calls on ARM64 phones. Telegram fixed it in version 12.10.4, released in late September. No CVE was assigned as of October 29, and there is no public technical write-up, so the step from memory corruption to code execution rests on NebuSec's demo video. Separately, ZDI published an advisory on October 15 for CVE-2026-111105 (CVSS 7.0), an unpatched flaw in rlottie, the animated-sticker library historically used by Telegram apps.
Technical Details
During a Telegram call, peers exchange MediaState messages reporting microphone mute, camera state and video rotation. The parser for MediaState mishandled missing fields and accessed memory it should not: when a rotation value was present, the code checked it and then read the video-state field even when absent. Version 12.10.4 reads rotation from the correct field. The calling code using this message was enabled in 8.6.2. The shared tgcalls library received the equivalent "Fix camera rotation" change on April 21, 2026, reaching iOS 12.7 (May) and desktop 7.0.1 (July) before Android; exploitability in those apps is unshown. NebuSec attributes discovery to its Code Security product running on OpenAI GPT-5.4. Researcher Saifeldeen Aziz reports that Telegram's server-side checks mitigating the rlottie bug could be bypassed, chaining AI-guided-fuzzing-found memory-corruption bugs into code execution on Telegram for iOS. Android swapped rlottie for the Rust-based tlottie between 12.8.1 and 12.10.0; desktop in September; iOS added tlottie in 13.0 while retaining rlottie.
Remediation
Update Telegram for Android to 12.10.4 or later (version shown at the bottom of Settings). Treat unsolicited voice calls from unknown accounts with caution on unpatched devices.