MeridianMeridian

Critical Telegram Android Flaw Allowed Full Device Takeover via Voice Call

Researchers at NebuSec disclosed a critical vulnerability in the Telegram Android app that, when chained with two additional bugs, enabled remote attackers to escape the application sandbox, obtain root privileges, and gain complete control over the victim's device. The attack required only that the target accept an incoming voice call from the attacker. The flaw affected versions 8.6.2 through 12.10.3 and was fixed in 12.10.4 released at the end of September 2026. NebuSec discovered the issue using their Code Security product powered by OpenAI's GPT-5.4 model. The vulnerability resided in the handling of MediaState messages exchanged during voice calls and allowed out-of-bounds memory access on ARM64 devices. Separately, Zero Day Initiative published details of an unpatched rlottie library flaw (CVE-2026-111105) also affecting Telegram clients across platforms.

ekurakTranslated from Polish

Read at source

Researchers from NebuSec have revealed a critical vulnerability in the Telegram Android application that, when combined with two other bugs, allowed attackers to gain full control over a victim's device simply by having the target accept a voice call.

The flaw existed in versions 8.6.2 to 12.10.3, released between March 2022 and September 2026, and was addressed in version 12.10.4. Exploitation enabled escape from the Telegram application sandbox, followed by root privilege escalation that granted access to messages, the microphone, and the camera.

Attack Mechanics

The vulnerability was triggered during voice call signaling. Both clients exchange messages to establish and manage the call state. One message type, MediaState, reports microphone mute status, camera activation, and image rotation. The affected code incorrectly handled missing fields, resulting in unauthorized memory access.

Once the initial escape was achieved, a separate Android root exploit completed the chain, giving the attacker complete device control. The researchers demonstrated the attack in a video showing the victim's phone switching to the home screen and displaying the message “HACKED BY NEBUSEC” approximately 30 seconds after the call began.

Disclosure and Additional Findings

NebuSec reported the issue to Telegram on 26 September after the patch had already been released. Telegram acknowledged receipt but did not classify the bug as remote code execution, so no CVE was assigned and no bug bounty was paid. The company confirmed the vulnerability affected ARM64 devices during voice calls but found no impact on iOS, desktop clients, or group calls.

In a related disclosure, Zero Day Initiative published details of an unpatched flaw (CVE-2026-111105) in the rlottie library used by Telegram for animated stickers. The issue, rated 7.0 CVSS, could allow malicious code execution when a user opens a crafted sticker. Telegram later replaced rlottie with its Rust-based tlottie library in Android and desktop versions, while iOS retained the older library longer.

Users are advised to update Telegram to version 12.10.4 or later on Android and to block calls from unknown contacts to reduce exposure.

TelegramNebuSecGPT-5.4CVE-2026-111105rlottieZero Day Initiative
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

Recognizing and Reducing Security Debt in IT Security
Vulns & Exploits

Recognizing and Reducing Security Debt in IT Security

Security Debt refers to the accumulation of deferred or incomplete security measures that organizations take to meet short-term project demands. These compromises, such as postponed patches, continued operation of legacy systems, and partially implemented protections, create growing risks that attackers can exploit later. The article explains how this invisible liability builds unnoticed when security shortfalls are not tracked or prioritized. CISOs and IT teams are advised to treat Security Debt as a manageable obligation rather than an inevitable cost of doing business. Without systematic identification and reduction, organizations ultimately pay through higher remediation expenses or actual security incidents. The concept draws a direct parallel to Technical Debt but applies specifically to security posture and long-term risk exposure.

Security-InsiderNov 9, 2026Translated from German

Brotli Buffer Overflow Flaw Exposes Node.js to Remote Code Execution and DoS Attacks
Vulns & Exploits

Brotli Buffer Overflow Flaw Exposes Node.js to Remote Code Execution and DoS Attacks

A critical buffer overflow vulnerability in Google's Brotli compression library allows remote attackers to corrupt memory, leak data, trigger denial-of-service conditions, or potentially execute arbitrary code. The flaw affects Brotli versions 1.0.3 through 1.2.0 and impacts applications that decompress attacker-supplied Brotli data, including multiple Node.js release lines. The root cause lies in the decoder incorrectly treating an invalid block transition as a temporary need for more input instead of a fatal format error, causing writes beyond an eight-byte internal buffer. Security updates have been released for the library itself as well as for Node.js versions 22, 24, and 26. Organizations are advised to inventory all affected software, containers, and packages and apply the available patches without delay.

Security-InsiderNov 9, 2026Translated from German

SonicWall Warns of SonicOS Flaw Allowing SAML MFA Bypass in SSL-VPN
Vulns & Exploits

SonicWall Warns of SonicOS Flaw Allowing SAML MFA Bypass in SSL-VPN

SonicWall has issued a security advisory for a vulnerability in its SonicOS operating system that powers the company's firewalls. The flaw, tracked as CVE-2026-19868, enables attackers who already possess valid SSL-VPN credentials to circumvent SAML authentication controls and the multi-factor authentication enforced by SAML. The company released patches to address the issue and stated it investigated a report indicating possible exploitation. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also confirmed active abuse of the vulnerability. No technical details about the attacks or their timeline have been disclosed. SonicWall urges customers to apply the updates immediately due to the associated risks.

Security.NLNov 7, 2026Translated from NL