A security flaw in Telegram for Android allowed an ordinary account to execute arbitrary code on a victim’s phone simply upon answering a voice call. Publicly disclosed on October 29, 2026, by security startup NebuSec, the vulnerability highlights significant risks associated with how applications handle incoming communication sessions. The issue demonstrates how malicious actors could compromise target devices without requiring user interaction beyond standard call handling.
The vulnerability originates from improper memory access when the application processes incoming MediaState call-setup messages that contain missing fields. According to the disclosures, this flaw specifically impacts the rlottie component used within the messaging platform. When improper memory management occurs during these call-setup sequences, it opens the door for attackers to corrupt memory and achieve code execution.
Tracked as CVE-2026-111105, the security defect affects Telegram for Android versions 8.6.2 through 12.10.3. Security researchers at NebuSec discovered the vulnerability using the company’s Code Security product powered by OpenAI’s GPT-5.4 model. The exploitation status of this issue involves a publicly demonstrated proof of concept, showing that attackers could leverage the flawed MediaState message handling to target vulnerable installations.
Following the discovery, Telegram addressed the security defect by releasing a software patch in version 12.10.4 in late September 2026. The public disclosure on October 29, 2026, brought widespread attention to the bug after researchers completed their analysis and demonstrated the attack vector. Users running unpatched versions of the messaging application remained exposed until updating their software.
The discovery underscores the critical importance of secure memory management in widely used messaging applications that handle complex data streams. Because millions of users rely on mobile messaging platforms daily, vulnerabilities that trigger execution upon answering a simple voice call present severe security implications. Compromised devices could grant malicious actors unauthorized access to personal data and device functions.
Security teams recommend ensuring that Telegram for Android is updated to version 12.10.4 or later to mitigate the risks associated with CVE-2026-111105. Maintaining up-to-date mobile applications remains a vital defense against emerging code execution techniques. As automated tools and AI-driven discovery methods uncover deeper software flaws, prompt patching practices continue to form the backbone of user safety.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
