Telegram Android 12.10.4 Flaw Allowed Call-Triggered Code Execution

Key points

• Telegram Android 12.10.4 was affected by a remote code execution issue.
• Attackers could trigger it by getting a user to accept a voice call.
• Successful exploitation could compromise the phone.
• The flaw was fixed and publicly disclosed on October 29 after late-September activity.
• No CVE identifier was assigned.

Telegram's Android client at version 12.10.4 contained a security defect that could let an attacker execute code on a victim's handset. The trigger was unusually simple: the target had to accept an incoming voice call. Once that happened, the attacker could run code, putting the entire phone at risk. The problem applied to the affected releases of the app, not to every Telegram build.

NebuSec is named in the disclosure, and the activity appears to have been observed around late September. Telegram corrected the defect, and details were made public on October 29. No CVE identifier has been attached to the case, which can complicate tracking and patch-prioritization for defenders who rely on CVE feeds.

For schools and government users, the lesson is that messaging clients are high-value endpoints. A single accepted call can expose contacts, messages, files, and session tokens, and may provide a foothold for further access. The risk is highest where staff install apps outside managed update channels or delay updates.

Because the vendor has fixed the issue, exposure is concentrated among users who remain on older Android builds. Administrators should verify installed versions, push updates where possible, and remind staff that unexpected voice calls from unknown contacts are not routine. Watch for follow-on reports about exploitation in the wild and for any updated advisory that assigns an identifier or expands the affected version range.

What to do now

1. Inventory Telegram Android installations and identify devices running version 12.10.4 or other affected builds.
2. Push the corrected Telegram release through MDM or managed Google Play, and block sideloaded installs on managed devices.
3. Where Telegram is not business-justified, restrict or remove it from managed endpoints until compliance is verified.
4. Brief staff not to accept unexpected voice calls from unknown contacts and to report suspicious call activity.
5. Monitor for unusual app behavior, new account sessions, and unexpected access to messages or files on affected devices.
6. Track the vendor advisory closely because no CVE identifier is available for standard vulnerability feeds.
7. For BYOD, require compliance attestation showing the Telegram app has been updated to a fixed version.

Original source

The Hacker News