Security startup NebuSec says Telegram for Android versions 8.6.2 through 12.10.3 had a flaw that let an attacker run code on your phone once you answered their voice call. All they needed was an ordinary Telegram account.
Details
The bug sits in the call-setup messages the two apps exchange, including one called MediaState. NebuSec confirmed it on ARM64 phones in private calls. It hasn’t seen evidence it affects iOS, desktop or group calls. There’s no CVE yet, and no word on in-the-wild use.
What to do
Telegram fixed it in 12.10.4 back in late September. Check Settings, scroll to the bottom and make sure you’re on 12.10.4 or later. And don’t answer calls from strangers.
God Bless, and May the Source Be with You!
