Messaging platform Telegram has deployed an emergency security update for its Android client to remediate a critical vulnerability that allowed remote attackers to execute arbitrary code and achieve complete device compromise when a user answered an incoming voice call. The flaw, uncovered and privately disclosed by researchers at cybersecurity research firm NebuSec, affected virtually all versions of Telegram for Android released between 2022 and late October 2026.

Because Telegram boasts over 900 million active monthly users worldwide, the presence of a remote execution vector in core voice calling logic presented an acute risk to corporate executives, journalists, and mobile users.

Vulnerability Mechanics: WebRTC Audio Stream Memory Corruption

Telegram utilizes customized forks of the open-source WebRTC protocol library to establish peer-to-peer and relayed encrypted voice and video communications. When an incoming voice call is initiated, the caller and receiver exchange Session Description Protocol (SDP) metadata packets detailing supported audio codecs, sample rates, and cryptographic key material.

The NebuSec researchers discovered that Telegram's Android implementation contained an unconstrained buffer allocation error within its native C++ audio processing pipeline:

  1. Crafted Audio Codec Payload: The attacker initiates a standard Telegram call, sending a crafted SDP offer containing an anomalous Opus audio channel configuration with out-of-spec packetization intervals.
  2. Heap Buffer Corruption: When the victim taps "Answer," the Telegram client passes the unvalidated audio parameters into its native memory decoder. The calculation allocating the audio jitter buffer overflows, allowing malformed audio packets to write arbitrary byte sequences past the bounds of the allocated heap chunk.
  3. Control Flow Hijacking: By carefully structuring the initial voice packets, the researchers demonstrated reliable control flow hijacking on ARM64 devices, bypassing Android's Address Space Layout Randomization (ASLR) and achieving arbitrary payload execution within the application's process space.

Exploitation Pre-Requisites and Threat Assessment

The operational barrier to exploitation was remarkably low:

  • No Prior Contact Required: The attacker only required the victim's Telegram username or phone number. If the victim's privacy settings allowed incoming calls from unknown contacts, the attack could be launched directly.
  • Single Interaction: Unlike complex phishing lures requiring credential entry or APK downloads, the attack succeeded the moment the victim answered the ringing voice call.
  • Permissions Inherited: The resulting shell payload inherited all permissions granted to Telegram—including access to the microphone, camera, contacts, local storage, SMS database, and precise GPS location.

Remediation in Telegram for Android v12.10.4

Telegram remediated the vulnerability in version 12.10.4 by refactoring the native audio packet parser, enforcing strict boundary checks on all incoming SDP codec parameters, and sandboxing audio stream processing routines.

# Verification Checklist for Android Users and MDM Administrators:
1. Open Telegram -> Settings -> Scroll to the bottom
2. Verify that the version reports "Telegram for Android v12.10.4" (or higher)
3. If using Google Play Store, immediately trigger pending app updates
4. Enterprise MDM administrators should enforce minimum build compliance policies:
   org.telegram.messenger >= 12.10.4