Telegram Android vulnerability allows remote code execution via voice calls

A security flaw in Telegram for Android could allow attackers to gain full control of a device when a user answers a voice call, according to security startup NebuSec. The vulnerability, which affects versions released between March 2022 and September 2024, can be combined with two other flaws to bypass application protections and access the Android system.

If combined with a root access exploit, an attacker could potentially access messages, the microphone, and the camera. The issue specifically involves how the application processes data packets during calls on ARM64 architecture.

Telegram has released a fix in version 12.10.4. Users are advised to update their application or set call privacy settings to “Nobody” to prevent such attacks. NebuSec reported that they have not observed this flaw being used in real-world attacks. There is currently no evidence that the vulnerability affects iOS or desktop versions of the app.