rlottie

Critical Telegram Android Flaw Allowed Full Device Takeover via Voice Call

Researchers at NebuSec disclosed a critical vulnerability in the Telegram Android app that, when chained with two additional bugs, enabled remote attackers to escape the application sandbox, obtain root privileges, and gain complete control over the victim's device. The attack required only that the target accept an incoming voice call from the attacker. The flaw affected versions 8.6.2 through 12.10.3 and was fixed in 12.10.4 released at the end of September 2026. NebuSec discovered the issue using their Code Security product powered by OpenAI's GPT-5.4 model. The vulnerability resided in the handling of MediaState messages exchanged during voice calls and allowed out-of-bounds memory access on ARM64 devices. Separately, Zero Day Initiative published details of an unpatched rlottie library flaw (CVE-2026-111105) also affecting Telegram clients across platforms.