If you run Telegram for Android and you’re not on version 12.10.4, answering a voice call could be the last thing you do on a device you actually control. Security researchers at NebuSec have documented a memory-corruption bug in how Telegram parses voice-call signaling that, chained with two other flaws, gives an attacker full control of your phone — your messages, microphone, and camera. It’s unpatched on every Android build from 8.6.2 through 12.10.3, that’s roughly four and a half years of installs, and the fix shipped in late September. If you haven’t updated, this is a “stop what you’re doing” kind of moment.

What’s actually broken

The vulnerability sits in the code that reads MediaState messages during a Telegram voice call. That code didn’t handle missing fields correctly and accessed memory it should never have touched. When a MediaState message included a rotation value, the code checked that value and then read a different field — the video state — even when the message had no such field. Reading memory that isn’t there is the textbook definition of an out-of-bounds access, and it’s exactly the kind of bug that turns into code execution in the hands of someone who knows what they’re doing.

Here’s the important part for how dangerous this is: the attacker needs nothing more than an ordinary Telegram account and your phone number. No special infrastructure, no operator-level access. Just send you a voice call, get you to press the green button, and the exploit path opens.

Escaping the app and owning the device

Alone, the MediaState bug keeps the attacker inside Telegram’s sandbox. That’s why the researchers chain it. The first link is an information-leak bug that lets the attacker break out of the app and reach Android itself. From there, an Android root exploit finishes the job, dropping the attacker to the bottom of the security model where they can read your messages, flip on the microphone, and access the camera. NebuSec pursued a similar path earlier this year, moving from a Firefox flaw all the way to the kernel of an ARM64 Android device.

Telegram disputed whether this could actually be turned into remote code execution, but the source code tells a different story. A review of the 12.10.3 signaling code shows the flaw exactly as described, and version 12.10.4 reads the rotation value from the correct field instead of trusting a value that may not exist.

What you should do right now

The fix is one version and it works. Here’s your checklist:

• Update immediately. Open Telegram for Android and verify you’re on 12.10.4 or newer. The version number sits at the bottom of Settings. If you’re below it, update — there’s no workaround.
• Turn on automatic updates for Telegram in the Play Store so you don’t sit unpatched for weeks again.
• Be skeptical of unsolicited calls. Even patched, treat an unexpected voice call from an unknown number — on any app — as a signal to hang up, not to chat.
• Common sense applies to your messaging app. If a product you use daily can go from a random call to full device control, the only reliable defense is a current version. Version numbers aren’t a vanity metric; they’re your front line.

Note this specific flaw had no CVE assigned as of disclosure, so don’t wait for a CVE alert to tell you it’s real — the patch is out and the researchers have shown it’s dangerous. Update, then move on with the knowledge that an old Telegram build is an open door on the most personal device you own.