A flaw in Telegram’s Android client allowed an attacker with an ordinary Telegram account to run code on a victim’s phone when the victim answered a voice call, researchers at security startup NebuSec reported. Telegram fixed the bug in version 12.10.4, released in late September; NebuSec disclosed the issue on October 29.
How the MediaState parsing bug could lead to remote code execution
NebuSec traced the problem to code that reads MediaState messages exchanged during a Telegram call. MediaState messages report microphone mute state, whether the camera is on, and a video rotation value. According to NebuSec, the reader did not handle missing fields correctly and accessed memory it should not.
A review by The Hacker News of Telegram’s published source code for version 12.10.3 found code that matched that description: when a MediaState message included a rotation value the code checked that value, but then read a different field — the video state — even if the message had no such field. The improper field access provided the mechanism NebuSec says it used to run code on a target device.
Which Telegram apps and versions were touched
NebuSec said the flaw can be triggered in every Android version from 8.6.2 through 12.10.3; those releases span March 2022 through September 2026. Telegram corrected the reading of the rotation value in version 12.10.4 of the Android app, released in late September.
Telegram’s Android, iOS, and desktop apps share a calls library named tgcalls. A change labeled “Fix camera rotation” was made in tgcalls on April 21, 2026. That change appears in Telegram’s iOS source code starting with version 12.7 (released in May), in the desktop app from version 7.0.1 (released in July), and in Android with version 12.10.4 (September). NebuSec told The Hacker News it confirmed the issue in private phone calls on ARM64-based phones and has no evidence so far that the bug directly affected Telegram’s iOS and desktop apps or group calls.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageNebuSec’s demonstration and the public evidence
NebuSec published a video showing two phones labeled “attacker” and “victim.” The victim accepts a Telegram call; about half a minute into the call the victim’s phone returns to its home screen, app icons fall down the display, and a “HACKED BY NEBUSEC” logo appears. The video does not show which Telegram or Android version the victim’s phone was running.
The company disclosed the bug on October 29 but, as of that date, had not posted a technical write-up on its website. The Hacker News asked NebuSec and Telegram whether the flaw had been used in real attacks and what parts of a phone an attacker’s code could reach; those questions were reported as asked but the public record in the source does not report answers to them. The flaw had no CVE identifier as of October 29.
Related advisory: rlottie, CVE-2026-111105, and the move to tlottie
Separately, the Zero Day Initiative published an advisory on October 15 for an unpatched flaw in rlottie used by Telegram apps to render animated stickers. ZDI tracked that issue as CVE-2026-111105 (CVSS 7.0) and said it can let an attacker run code if a user opens a malicious file or page.
Telegram told ZDI in March that server-side checks mitigated the rlottie flaw and asked ZDI in April for a full remote-code-execution chain. Researcher Saifeldeen Aziz, in an abstract for an OffensiveCon talk, reported that those checks could be bypassed; his work used AI-guided fuzzing to find memory-corruption bugs in rlottie across Telegram’s iOS, Android, and desktop apps and chained them to run code on Telegram for iOS.
Telegram’s Android app replaced rlottie with tlottie, a Rust library, between versions 12.8.1 (June) and 12.10.0 (August). The desktop app switched in September. The iOS code added tlottie in version 13.0 (October) while still including rlottie.
What this means for end users, technologists and app maintainers
- End users: Anyone using Telegram for Android should confirm their app is on version 12.10.4 or later; the version number appears at the bottom of the app’s Settings page. That is the version Telegram published to correct the MediaState handling.
- Technologists and security teams: The flaw demonstrates how a malformed in-call message can induce unsafe memory access in shared call-handling code (tgcalls). Teams responsible for mobile-device security should prioritize updates for Android clients and review call-library changes across platforms.
- App maintainers and library authors: The rlottie advisory (CVE-2026-111105) and the tlottie transition highlight the risk of third-party rendering libraries. Maintainers should track upstream fixes, server-side delivery checks, and the impact of swapping libraries on different client platforms.
Telegram fixed the specific MediaState parsing bug in Android with version 12.10.4 in late September; NebuSec disclosed its findings on October 29. The public record includes a demonstration video and matching source-code observations for the Android client, a separate ZDI advisory for rlottie (CVE-2026-111105), and evidence that Telegram began replacing rlottie with tlottie across clients in mid-2026. Whether attackers have used the MediaState flaw in the wild, and how far an attacker’s code could reach on an exploited phone, remain questions not answered by the public materials cited here.
