Telegram Voice Call Flaw Enables Remote Code Execution on Android Devices
Security researchers disclosed on October 29, 2026 a vulnerability in Telegram for Android that allows arbitrary code execution on a victim's device simply by answering a voice call. The flaw resided in the handling of short MediaState messages exchanged during calls, where missing fields caused the application to read unauthorized memory. Telegram addressed the issue in version 12.10.4 released at the end of September 2026, covering versions from 8.6.2 through 12.10.3 issued between March 2022 and September 2026. The same underlying fix had been deployed earlier in the shared calling library on April 21, 2026, reaching iOS in May, desktop in July, and Android only in September. Researchers confirmed the impact exclusively on private calls running on ARM64 Android devices and found no evidence of exploitation on iOS, desktop, or group calls. Users are advised to check their Telegram version in settings and update immediately, while enterprise administrators should audit device fleets given the four-and-a-half-year span of affected releases.
BoletimSecOct 30, 2026Translated from Portuguese