NebuSec reports Telegram Android call RCE; update to 12.10.4 or later
NebuSec reports code execution after a victim answers a Telegram Android call. Android 12.10.4 contains the parser correction. Reported testing covers private calls on ARM64 phones; real-world exploitation and the full exploit chain remain unconfirmed.
- Disclosed
- Oct 29, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- Telegram Android 8.6.2–12.10.3 per the researcher’s report; victim must answer a private call; ARM64 tested
- android
- In the wild
- Unknown
- A researcher reports a demonstration; no confirmed real-world attacks are cited.
What happened
The public report concerns Android call signaling, not the separate animated-sticker research. It requires the victim to answer; describing it as zero-click would be misleading. L3 reflects a mainstream client and a public researcher claim, not evidence of ongoing attacks.
We compared Telegram’s published Android source: 12.10.3 checks for videoRotation but dereferences videoState in that branch; 12.10.4 uses the correct field. This confirms the parser correction, not an independently reproduced code-execution chain. The reported 8.6.2–12.10.3 range and ARM64 private-call testing come from NebuSec’s account to The Hacker News. They do not establish iOS, desktop or group-call exploitation, device-wide access, or victims. No CVE is identified in the cited disclosure.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Telegram for Android | 12.10.4 | Parser correction included |
Crime-scene timeline
Sep 24, 2026
Android 12.10.4 source update contains the correction
Oct 29, 2026
NebuSec publicly reports call-triggered code execution
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- NebuSec disclosureResearcher claims call-triggered Telegram RCE; original post was read through its official embed.
- Official X embed of the NebuSec postPrimaryPrimary copy dates the researcher’s public RCE claim to October 29.
- Telegram Android 12.10.3 parserPrimaryThe rotation branch reads videoState rather than videoRotation.
- Telegram Android 12.10.4 parserPrimaryThe corrected branch reads videoRotation; repository commit identifies 12.10.4 (7099).
- The Hacker NewsReports NebuSec’s affected range, ARM64 private-call testing and lack of a public full-chain write-up.
- Telegram Android 12.10.4 source commitPrimaryCommit metadata dates the 12.10.4 (7099) source update to September 24, 2026.