Telegram Android Voice Call RCE: How a Single Missed Patch Exposed 900 Million Users to Code Execution
Executive Summary
In October 2026, security startup NebuSec disclosed a critical remote code execution vulnerability in Telegram for Android affecting versions 8.6.2 through 12.10.3—a window spanning March 2022 to September 2026. The flaw resided in the MediaState message-parsing logic used during voice calls: malformed signaling packets triggered an out-of-bounds memory access in the tgcalls shared library, enabling an attacker with only a standard Telegram account to execute arbitrary code on a victim's ARM64 Android device the moment the victim answered a call. Telegram silently patched the vulnerability in version 12.10.4, released late September 2026.
This incident underscores a widening attack surface in consumer-grade encrypted messaging platforms as they become critical business communication tools. AI-assisted code analysis—used by NebuSec to find the flaw—is accelerating both offensive discovery and defensive review cycles, raising the bar for security teams who must now assume adversaries can find and weaponize zero-days in broadly deployed mobile applications faster than ever before.
Why This Matters Now
Telegram's 900-million-plus user base makes zero-click-adjacent mobile RCE vulnerabilities like this extraordinarily high-value targets for nation-state actors and cybercriminal groups. With AI-guided fuzzing democratizing exploit discovery and a parallel unpatched rlottie sticker-parsing flaw (CVE-2026-111105) still circulating, enterprise security teams must urgently audit mobile application versions across managed and unmanaged devices before adversaries chain these vulnerabilities into full device compromises.
Attack Path Analysis
An attacker with an ordinary Telegram account initiated a voice call to a victim running a vulnerable Telegram for Android version (8.6.2–12.10.3); upon the victim answering, a crafted MediaState signaling message exploited a memory-corruption flaw in the tgcalls JNI layer, triggering out-of-bounds memory access that enabled remote code execution on the victim's ARM64 Android device. Post-compromise, the attacker's injected code operated within the context of the Telegram process, potentially enabling privilege escalation, data access, lateral pivot to backend services, and exfiltration of sensitive on-device data — all without any user interaction beyond answering the call.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
The attacker, possessing only a standard Telegram account, placed a voice call to a target running Telegram for Android versions 8.6.2 through 12.10.3. Upon the victim answering, the attacker sent a malformed MediaState signaling message — a crafted payload that set a rotation value triggering the vulnerable code path in Signaling.cpp to read an absent video state field, causing an out-of-bounds memory access. This memory corruption was leveraged to achieve remote code execution on the victim's ARM64 Android device without any further user interaction. No CVE identifier was assigned as of disclosure.
Related CVEs
CVE-2026-111105
CVSS 7A memory corruption vulnerability in the rlottie library used by Telegram apps to render animated stickers allows an attacker to execute arbitrary code when a user opens a malicious file or page. Server-side mitigations claimed by Telegram were found to be bypassable.
Affected Products:
Telegram Telegram for Android – < 12.8.1 (rlottie replaced by tlottie in 12.8.1-12.10.0)
Telegram Telegram for iOS – < 13.0 (rlottie still included alongside tlottie through 13.0)
Telegram Telegram Desktop – versions prior to tlottie migration in September 2026
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Exploitation for Client Execution
Exploit Public-Facing Application
Application or System Exploitation
Process Injection
System Network Configuration Discovery
Application Layer Protocol
Exploitation for Privilege Escalation
Command and Scripting Interpreter
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Malicious Code Protection / Software Integrity / Memory Protection
Control ID: SI-3 / SI-7 / SI-16
CISA Zero Trust Maturity Model 2.0 – Application-Level Threat Detection and Secure Communication Validation
Control ID: Application Pillar — Application Security / Visibility and Analytics
NIS2 Directive – Supply Chain Software Security and Vulnerability Disclosure
Control ID: Article 21(2)(d) — Supply Chain Security / Article 21(2)(e) — Incident Handling
GDPR (EU) 2016/679 – Security of Personal Data and Privacy Engineering
Control ID: Article 25 — Data Protection by Design and by Default / Article 32 — Security of Processing
PCI DSS 4.0 – Security Vulnerability Management and Software Development Security
Control ID: Requirement 6.3.3 / Requirement 6.4.1
ISO/IEC 27001:2022 – Vulnerability Management and Secure Software Development Lifecycle
Control ID: Annex A 8.8 — Management of Technical Vulnerabilities / Annex A 8.28 — Secure Coding
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Mobile RCE via Telegram voice calls exposes IT teams to device compromise, lateral movement, and data exfiltration risks, with compliance gaps across NIST.800-53.SC-7 and ZTMM.Network frameworks.
Financial Services
Telegram-based RCE threatens financial professionals using mobile communication, enabling attackers to exfiltrate sensitive data, violating PCI.4.0.4.2.1 and NIST.CSF.PR.DS-2 encrypted transit requirements.
Computer/Network Security
Security teams relying on Telegram for incident coordination face direct RCE exposure, undermining zero trust segmentation and threat detection capabilities mapped to HIPAA.164.308(a)(6) and ZTMM controls.
Government Administration
Government mobile users on Telegram risk remote code execution during calls, threatening sensitive communications and violating NIST.800-53.SC-12 and ZTMM.CrossCutting.Visibility compliance mandates.
Sources
- Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Callshttps://thehackernews.com/2026/10/telegram-android-flaw-lets-attackers.htmlVerified
- ZDI-26-757: Zero Day Initiative Advisory on rlottie Vulnerability in Telegramhttps://www.zerodayinitiative.com/advisories/ZDI-26-757/Verified
- NebuSec Security Disclosure - Telegram Voice Call RCEhttps://x.com/nebusecurity/status/2115601122727702634Verified
- Telegram Android Source Code - Signaling.cpp v12.10.3 (vulnerable)https://github.com/DrKLO/Telegram/blob/9552e5541e1274b9557c9832b204dbfcaf44b3dc/TMessagesProj/jni/voip/tgcalls/v2/Signaling.cpp#L718-L738Verified
- Telegram Android Source Code - Signaling.cpp v12.10.4 (patched)https://github.com/DrKLO/Telegram/blob/c84801762fd5f936c8296ecf09a14a48ebfc4fe4/TMessagesProj/jni/voip/tgcalls/v2/Signaling.cpp#L725-L745Verified
- tgcalls Fix Camera Rotation Commit (April 21, 2026)https://github.com/TelegramMessenger/tgcalls/commit/a6ea40ebf18233fad5aae29aa3d30561f839a6a8Verified
- OffensiveCon 2026 - Saifeldeen Aziz: AI-Guided Fuzzing of rlottie in Telegramhttps://www.offensivecon.jp/speakers/2026/saifeldeen-aziz.htmlVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
This incident demonstrates how a single vulnerable mobile endpoint — reachable via an unauthenticated Telegram voice call — could serve as an entry point into broader organizational infrastructure through credential theft and lateral pivot to cloud-connected services. Aviatrix Zero Trust CNSF would likely reduce attacker reachability across cloud workloads and constrain the blast radius by enforcing segmented, identity-aware access policies that limit how far compromised device credentials can travel inside enterprise environments.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF visibility and fabric-wide policy enforcement would likely reduce the reachability of a compromised mobile device toward internal cloud workloads, limiting the initial foothold's ability to communicate with protected backend environments even after successful device exploitation.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain what an escalated process on a compromised device could reach inside cloud environments, reducing the privilege scope available to the attacker by ensuring that even root-level device access does not translate directly into broader cloud workload access.
Control: East-West Traffic Security
Mitigation: East-west traffic security controls would likely limit how far stolen credentials or hijacked sessions could be used to move laterally between cloud workloads and internal services, reducing the attacker's ability to freely pivot across segmented environments using compromised identity material.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and control capabilities would likely improve detection of anomalous outbound communication patterns from cloud-connected endpoints or workloads, potentially reducing the attacker's ability to maintain undetected C2 channels across cloud network boundaries.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security and policy enforcement would likely reduce the attacker's ability to move sensitive data from cloud-connected workloads to unauthorized external destinations, constraining exfiltration paths by limiting which outbound routes and endpoints are permitted under policy.
Even where device-level compromise cannot be prevented, the constrained lateral reachability and reduced egress paths enforced across earlier stages would likely limit the attacker's ability to translate a single device compromise into widespread enterprise damage, shrinking the overall blast radius across cloud-connected assets.
Impact at a Glance
Affected Business Functions
- Mobile Messaging and Voice Communications
- User Device Integrity and Privacy
- Application Security and Software Supply Chain
- End-User Data Confidentiality (contacts, messages, media)
Estimated downtime: N/A
Estimated loss: N/A
Any data accessible on a compromised Android device could be at risk, including private Telegram messages, media files, contacts, authentication tokens, and device credentials stored on ARM64-based Android phones. The voice-call RCE vector requires only that the victim answer a call from an attacker-controlled Telegram account, enabling silent device compromise across approximately four years of Telegram for Android releases (versions 8.6.2 through 12.10.3, March 2022 to September 2026). The full scope of code execution permissions post-exploitation has not been publicly disclosed by NebuSec. The rlottie CVE-2026-111105 additionally exposes iOS, Android, and desktop users to code execution via crafted animated sticker files, with server-side mitigations confirmed bypassable.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce egress security and FQDN-based policy controls (Egress Security & Policy Enforcement) to detect and block anomalous outbound connections from mobile or endpoint devices to unknown attacker-controlled infrastructure, limiting C2 channel establishment and data exfiltration post-exploitation.
- • Deploy Cloud Firewall (ACF) and Inline IPS (Suricata) capabilities to inspect and block known exploit traffic patterns and malicious payloads at the network perimeter; while encrypted traffic limits deep inspection, signature-based detection of known RCE payload patterns can flag suspicious call-signaling anomalies before code execution completes.
- • Apply Zero Trust Segmentation and least-privilege identity-based policies to contain post-compromise lateral movement — ensuring that even if a mobile endpoint is fully compromised, the attacker cannot use harvested credentials or tokens to pivot freely into cloud workloads, enterprise SaaS, or backend services without continuous identity verification.
- • Leverage Multicloud Visibility & Control and Threat Detection & Anomaly Response capabilities to baseline normal outbound traffic from mobile-connected endpoints and raise alerts on anomalous volumes, unexpected destinations, or covert channel behaviors indicative of an active C2 session following device compromise.
- • Utilize Encrypted Traffic (HPE) controls to protect data in transit across all enterprise network segments, ensuring that even if an attacker intercepts traffic from a compromised device, sensitive organizational data remains unreadable — and mandate immediate patch enforcement policies requiring Telegram for Android version 12.10.4 or later across all managed devices.
