A discovered flaw in Telegram for Android versions 8.6.2 through 12.10.3 allowed code execution via an answered voice call, impacting the codebase responsible for parsing MediaState messages.
Telegram patched the issue in version 12.10.4.
The issue was discovered by security firm NebuSec using an artificial intelligence tool. According to the company, the attacker only needed a simple account on the service to target a user.
Which devices were affected?
The issue affected all versions of the app from 8.6.2 to 12.10.3, which were released from March 2022 to September 2026. Telegram released version 12.10.4 in late September, which fixes the problem.
Researchers confirmed the issue in test calls on phones with ARM64 processors. So far, there is no evidence that group calls or the iPhone and desktop versions of the app were affected.
How did the problem work?
The bug was in the code that reads status messages during calls, which are used to report the status of the microphone and camera.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
Cisco fixes serious security flaw already being used in attacks
↗
In a video released by the researchers, it appears that once the victim accepted the call, the phone's screen would display changed icons and a message from the test's creators. As of October 29, the issue had not been officially identified.
Separately, on October 15, another group published a warning about a different, unpatched issue in a software library used for animated stickers.
What users should do
Those using Telegram on Android should make sure their app is updated to version 12.10.4 or higher. The version number can be found at the bottom of the settings page.
G
HACKS.GR / GOOGLE SEARCH
Hacks.gr on Google
Set Hacks.gr as a preferred source.
Preferred source
↗
end of article
Top comments (0)