Security researchers disclosed on October 29, 2026 a vulnerability in Telegram for Android that allows arbitrary code execution on a victim's device simply by answering a voice call. The attacker requires only a standard account, and no special privileges are needed.
The flaw resided in the handling of short MediaState messages exchanged during calls. These messages report whether the microphone is muted, whether the camera is active, and the rotation state of the video. The code mishandled absent fields and ended up reading memory it should not have accessed.
Telegram addressed the issue in version 12.10.4 released at the end of September 2026. The affected range spans versions 8.6.2 through 12.10.3, published between March 2022 and September 2026. No CVE identifier has yet been assigned to this specific flaw, and there are no public records of real-world exploitation as of the disclosure date.
According to reporting by The Hacker News, the defect is visible in the publicly released source code of version 12.10.3. When the rotation value is present, the code validates it and then incorrectly reads the video state field even when that field is absent. Version 12.10.4 reads the rotation value from the correct field instead.
The underlying fix was merged into the shared calling library on April 21, 2026. It reached iOS in version 12.7 in May, the desktop application in version 7.0.1 in July, and Android only in September. Researchers verified the effect solely on private calls running on ARM64 Android devices and stated they have no evidence that iOS, desktop, or group calls are affected.
No technical exploit analysis has been published, and the accompanying video demonstration does not disclose the exact versions used. The link between the memory error and code execution therefore rests on the researchers' account. Users should check the Telegram version at the bottom of the settings screen and update to 12.10.4 or later. Enterprise administrators are encouraged to inventory corporate devices, as the affected range covers four and a half years of releases and devices without automatic updates remain exposed.
This issue should be distinguished from CVE-2026-111105, a separate vulnerability rated 7.0 that the Zero Day Initiative disclosed in Telegram's animation library.
