Telegram Vulnerability Advisory
Lookout Coverage and Recommendation for Admins
Lookout will release security coverage on November 5, 2026. Upon deployment, the platform will automatically trigger alerts and remediation workflows aligned with each organization’s configured risk thresholds and escalation policies. Security teams and system administrators should deploy the following controls across managed fleets:
- Enforce Minimum Application Version: Mandate that all Android devices running Telegram update immediately to version 12.10.4 or higher via Google Play Store or enterprise mobile device management (MDM) repositories.
- Verify Client Build Numbers: Instruct users or audit inventory to verify installed builds under Settings in the Telegram app, cross-referencing the version string at the base of the menu.
- Restrict Inbound Calling Profiles: Distribute user guidance to restrict incoming voice calls under Settings > Privacy and Security > Calls to My Contacts or Nobody to neutralize unsolicited inbound exploit traffic.
- Block Non-Compliant Endpoints: Deploy MDM/MAM conditional access policies that revoke access to corporate resources and email for any device hosting unpatched versions of Telegram until verified compliant.
Overview
Security researchers at NebuSec have disclosed a critical remote code execution (RCE) vulnerability in Telegram for Android. The flaw allows an attacker using a standard, unprivileged Telegram account to execute arbitrary code remotely on a victim's Android device simply by initiating a voice call that the target answers.
The vulnerability affects versions of Telegram for Android later than build 8.6.1 and prior to build 12.10.4. Telegram addressed the issue in late September 2026 with the release of version 12.10.4. Because the flaw triggers at the protocol level during standard voice call handling, organizations and individuals must verify that Telegram for Android is updated to build 12.10.4 or later across all personal, enrolled, and BYOD devices.
While the issue has not received a formal CVE identifier as of late October 2026, its threat profile—zero elevated privileges required, minimal user interaction (answering a call), remote delivery, and direct code execution—makes remediation an immediate priority.
Lookout Analysis
Messaging and VoIP applications continuously process real-time network streams, meaning untrusted media packets parsed before and during an active call present an expansive attack surface. By chaining low-level protocol weaknesses, an attacker can transition from establishing an audio handshake directly to executing unauthorized binary instructions within the application sandbox.
Attack Lifecycle
- Target Identification & Initiation
The attacker obtains the target’s Telegram handle or phone number and initiates an ordinary voice call from an unprivileged account. - Delivery via Protocol Streams
The attacker injects specially crafted payload sequences into the initial voice call negotiation and RTP/media stream setup. - Trigger via Call Acceptance
The victim accepts the incoming call. Answering immediately triggers the vulnerable parsing routine, causing memory corruption without requiring file downloads, link clicks, or altered OS permissions. - Remote Code Execution & Device Compromise
The exploit achieves arbitrary code execution within the context of the Telegram application, exposing local message databases, media caches, contact lists, and active microphone permissions, while creating an initial foothold on the device.
Authors
Lookout
