Ethical Hacking News
A recent discovery has brought to light a severe vulnerability in the Telegram Android app that enables attackers to run malicious code on a victim's device via a voice call. The vulnerability was found to be present in every version of Telegram for Android from 8.6.2 to 12.10.3 and has been fixed in version 12.10.4. Users are advised to ensure their app is updated to the latest version to prevent exploitation. This finding highlights the need for ongoing security testing and vulnerability assessments, as well as the importance of staying informed and taking proactive measures to protect yourself against emerging threats.
Telegram Android app has a severe vulnerability that allows attackers to run malicious code via voice calls. The vulnerability affects all versions of Telegram for Android from 8.6.2 to 12.10.3. The flaw was discovered in the code that reads MediaState messages and could execute arbitrary code. Telegram has fixed the issue in version 12.10.4 of the app, but users are advised to update to prevent exploitation. Other recent vulnerabilities include unpatched flaws in the rlottie library and PHP2Shell library.
A recent discovery has brought to light a severe vulnerability in the Telegram Android app that enables attackers to run malicious code on a victim's device via a voice call. This finding is particularly alarming, as it highlights the need for users to remain vigilant and take proactive measures to protect themselves against such threats.
The vulnerability was discovered by security startup NebuSec, which reported that the flaw in Telegram for Android allowed an attacker to execute arbitrary code on a device's phone once the user answered a voice call from a malicious source. According to NebuSec, the attacker only needed an ordinary Telegram account to exploit this vulnerability. The flaw was found to be present in every version of Telegram for Android from 8.6.2 to 12.10.3, which were released between March 2022 and September 2026.
The vulnerability was found to be triggered in the code that reads MediaState messages, which reports information about the device's microphone, camera, and video settings. According to NebuSec, the code did not handle missing fields correctly and accessed memory it should not have. This led to a situation where the code could potentially execute arbitrary code, allowing an attacker to run malicious code on the device.
Telegram has since fixed the flaw in version 12.10.4 of the app, which was released in September. The company has confirmed that the vulnerability does not affect its iOS and desktop apps, as well as group calls. However, users are still advised to ensure that their app is updated to version 12.10.4 or later to prevent exploitation.
The discovery of this vulnerability highlights the importance of ongoing security testing and vulnerability assessments. It also serves as a reminder that even seemingly secure apps can have hidden vulnerabilities waiting to be exploited. As the use of voice assistants and voice calls becomes increasingly common, it is essential that users remain vigilant and take steps to protect themselves against such threats.
In addition to the Telegram vulnerability, there have been other recent findings that highlight the importance of staying up to date with security patches. For example, the Zero Day Initiative has published an advisory about an unpatched flaw in the rlottie library, which can allow an attacker to run code if a user opens a malicious file or page. Similarly, researchers have discovered a flaw in the PHP2Shell library that can allow an attacker to execute arbitrary code on a device.
These findings demonstrate the importance of staying informed and taking proactive measures to protect yourself against emerging threats. As the landscape of cyber threats continues to evolve, it is essential that users remain vigilant and take steps to protect themselves against such threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Android-App-Vulnerability-Allows-Attackers-to-Run-Code-via-Voice-Calls-ehn.shtml
https://thehackernews.com/2026/10/telegram-android-flaw-lets-attackers.html
Published: Thu Oct 29 07:45:32 2026 by llama3.2 3B Q4_K_M
