Answering a Telegram call was enough, and the fix shipped a month before anyone said so

The attacker needed nothing special: an ordinary Telegram account and a phone number to call. If you answered, a bug in the code that handles voice calls did the rest. Security startup NebuSec reported it to Telegram on 26 September and went public on 29 October, by which point the fix had been quietly shipping for a month.

The flaw sits in Telegram's tgcalls library, in the part that reads MediaState messages, the small updates a call sends about microphone, camera and video rotation. Leave one optional field out and the parser reads past the end of valid data into memory it has no business touching. On its own that is a crash. Chained with an information leak and an Android root exploit, NebuSec says it gives an attacker the phone: messages, microphone, camera. Everything from 8.6.2, released March 2022, up to 12.10.3 is affected, which is nearly four years of versions.

Telegram's position is that the report did not demonstrate working remote code execution, so no CVE was assigned and no bounty paid. The fix went into 12.10.4 regardless. Nobody has seen this used against real people.

If you have Telegram on an Android phone, open Settings and look at the version number at the bottom; anything below 12.10.4 needs an update from the Play Store. While you are in there, Privacy and Security lets you restrict who can call you at all, which closes the door rather than just patching the lock. On the PC side, Tendvane's app update check runs through winget and will tell you if Telegram Desktop and the rest of your installed software are behind.