# NebuSec discloses Telegram Android flaw it says enabled code execution

_Published Thursday, October 29, 2026 at 9:24 AM EDT · Security · Latest · Tier 2 — Notable_

![NebuSec discloses Telegram Android flaw it says enabled code execution — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEguzUg6G-A4KdRvBuhj9LZ93cFfXfvMNkg3dJO0H9sfNJ3MTlecsgLEMIk5TnIrdl2N6UGB8D9rlqLduGEZVm7X-XrWZr6Xh5ZrVp38x5uTd1vHyHGcjRR2N3gctNen-CBSz8JihnNL57galBoeOVKwG5w3qsOZnqmGYdkxzjurrI3QWolmS1Qfz_E_Wog/s1700-nu-rw-lo-l85-e365/telegram.jpg)

Security startup NebuSec disclosed on October 29 that a Telegram Android flaw allowed an attacker with an ordinary account to run code on a phone after its user answered a voice call. Telegram fixed the flaw in version 12.10.4, released in late September; NebuSec says versions 8.6.2 through 12.10.3 are affected.

The flaw involves incorrectly reading a missing field in messages exchanged during calls. The Hacker News found matching faulty code and its correction in Telegram's published source.

NebuSec confirmed the issue in private calls on ARM64 phones. Its claimed progression from the flaw to code execution rests on its statements and a demonstration video; no technical write-up was available as of October 29.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/telegram-android-flaw-lets-attackers.html)

---
Canonical: https://techandbusiness.org/newswire/9R41pmUIcatunWKHZ39fsb
Published: 2026-10-29T13:24:30.843Z
Story chronology: 2026-10-29T11:39:00.000Z
Retrieved: 2026-10-29T15:57:12.944Z
Publisher: Tech & Business (techandbusiness.org)