Security AlertCritical
Telegram for Android flaw let attackers run code on answered voice calls
Oct 28, 2026 · Summarized by Fundy Tech from 3 sources
The 30-second version
A Telegram for Android flaw let an attacker run code when a victim answered a voice call. Telegram fixed it in version 12.10.4, and the issue affected versions 8.6.2 through 12.10.3.
Key points
- The attacker needed only an ordinary Telegram account.
- NebuSec disclosed the flaw on October 29.
- No CVE had been assigned as of October 29.
Why it matters
Anyone using Telegram for Android should update right away. For small businesses, a compromised phone could expose chats, contacts, and work accounts. Households should treat this as a prompt to update family devices and check app versions.
Who’s affected: Telegram for Android users
What to do
- Update Telegram for Android to version 12.10.4 or later.
- Check the version number in the app’s Settings page.
- Be cautious with incoming voice calls from unknown accounts.
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.