Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls

A vulnerability in Telegram's Android app allowed attackers to execute code on a victim's device by making a voice call that the victim answered. The flaw affected versions 8.6.2 through 12.10.3 and was fixed in version 12.10.4 released in September 2026. The issue involved improper handling of MediaState messages during call setup, leading to memory access errors.