cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

NebuSec Says Telegram Android Flaw Could Enable Code Execution During Voice Calls

· Original article ↗

Summary

NebuSec says a Telegram for Android flaw could let a caller run code after the recipient answers. It affects versions 8.6.2–12.10.3 and was fixed in 12.10.4; the exploit demonstration lacks a disclosed app version, and in-the-wild use is unknown.

Key points

  • NebuSec says an attacker with an ordinary Telegram account could trigger the flaw by calling a victim who answers.
  • The reported affected range is Telegram for Android 8.6.2–12.10.3; version 12.10.4, released in September, contains the fix.
  • The flaw involves MediaState message parsing: code reportedly read a video-state field even when it was missing, causing an improper memory access. The Hacker News found matching flawed code in Telegram's published 12.10.3 source.
  • NebuSec says it tested the flaw in private calls on ARM64 phones. Its demonstration video does not identify the Telegram or Android version, and the article notes there was no technical write-up; the path from the bug to code execution therefore rests on the video and the company's claims.
  • Whether the flaw was used in real attacks was unknown. The article reports no evidence that it affected iOS, desktop, or group calls, and says exploitability in those apps was not shown.
  • Separately, ZDI reported an rlottie flaw, CVE-2026-111105, that it says could allow code execution when a user opens a malicious file or page; Telegram's code shows a transition to the Rust-based tlottie library in some app versions.

Article Details

Vulnerability Types
  • Incorrect handling of missing MediaState fields leading to invalid memory access
  • Memory-corruption bugs in rlottie sticker handling
Severity
CVSS 7.0 for CVE-2026-111105; severity not stated for the MediaState flaw.
Affected Versions
  • Telegram for Android 8.6.2 through 12.10.3
Exploitation Status
reported
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Update Telegram for Android to version 12.10.4 or later.

MITRE ATT&CK

T1203 · Exploitation for Client ExecutionNebuSec says the Telegram for Android MediaState flaw can be triggered during a voice call answered by the victim to run code; the public video does not identify the app version.

CVE

CVE-2026-111105flaw in rlottie, the library Telegram apps have used to draw animated stickers. The flaw, tracked as CVE-2026-111105 (CVSS score: 7.0), can let an attacker run code if a user opens a malicious file or page, ZDI said.

People

Saifeldeen AzizResearcher who said checks for the rlottie flaw could be bypassed; his research used AI-guided fuzzing to find and chain memory-corruption bugs in Telegram apps.

Vendors

NebuSecA flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec.TelegramA flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec.

Products

Code SecurityNebuSec, a startup backed by Y Combinator, says its Code Security product, which runs on OpenAI's GPT-5.4 model, found the flaw. In July, the company described an Android exploit chain that started with a Firefox flawTelegramA flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec.

Related Articles