A flaw in Telegram for Android let an attacker execute code on a victim's phone simply by placing a voice call — no link to click, no file to open, no permission prompt to approve. The victim only had to answer, and no prior contact with the victim was required. Telegram has shipped a fix in version 12.10.4, and security startup NebuSec disclosed the issue on 29 October, according to coverage by The Hacker News published the same day.
The lowest possible cooperation bar
What makes this vulnerability notable is how little it asks of the target. According to NebuSec, the attacker needed nothing more than an ordinary, freely registered Telegram account. From there, placing a voice call to the victim was enough to trigger the code execution once the call was answered. There is no malicious attachment, no phishing URL, and no user-permission dialogue in the chain — the ordinary act of answering a call is the attack surface.
That collapses the usual social-engineering threshold that most mobile exploits still depend on. Users who are careful about tapping unknown links or declining suspicious files gain nothing here, because the interaction looks and feels completely routine.
A patch-then-disclose gap
Telegram fixed the flaw in version 12.10.4 of the Android app, released in late September, but NebuSec's disclosure did not arrive until 29 October — a window of roughly a month. During that period, the shipped patch itself served as a public signal: anyone comparing the fixed build against its predecessor could plausibly reverse-engineer the underlying bug while the majority of users remained on unpatched versions. That gap is the strongest argument for updating immediately rather than waiting for independent corroboration or further reporting.
NebuSec states that the flaw can be triggered in every build the company examined prior to the fix. The available source summary does not carry a CVE identifier; readers should consult NebuSec's full write-up for the assigned identifier, if any, and the precise lower-bound affected version. NebuSec has also not stated whether the flaw was discovered through internal research or observed being exploited in the wild, and no public statement from Telegram beyond shipping the patch has been reported. Both points materially affect how urgent users should treat the update and warrant follow-up if clarified.
What to do now
The mitigation steps are straightforward and apply to any user running an affected build:
- Update the app. Install Telegram 12.10.4 or later from the Play Store or your managed app source immediately.
- Enable auto-updates for Telegram so future fixes land without waiting on a manual prompt.
- Treat missed calls with caution. An unanswered call from an unknown Telegram account is, for now, safer than an answered one — if you do not recognise the caller, do not pick up until your build is patched.
- Restrict who can call you. Under Settings → Privacy and Security → Calls, limit incoming calls to your contacts rather than everybody.
- Verify managed devices. Organisations distributing phones to staff should confirm the installed Telegram version through their MDM or device-management console and push the update where possible.
None of this is a Hong Kong-specific regulatory response; it is general hygiene. The core takeaway is simple: with the patch already available and the disclosure now public, the cost of updating is minutes, while the cost of waiting — against a bug that turns a phone call into remote code execution — is not worth measuring.
Telegram Android 版存在一個漏洞，攻擊者只需撥打一通語音通話，即可在受害者的手機上執行代碼——無需點擊任何連結、開啟任何檔案，亦無需批准任何權限提示。受害者只需接聽通話，而且事前完全無須與受害者有任何接觸。Telegram 已在 12.10.4 版本推出修復，保安初創公司 NebuSec 於 10 月 29 日披露有關問題，根據 The Hacker News 當日的報道。
最低限度的配合門檻
此漏洞之所以值得注意，在於其對目標的要求極低。根據 NebuSec，攻擊者只需一個普通、自由註冊的 Telegram 帳戶即可。由此，只要向受害者撥打語音通話，通話獲接聽後便足以觸發代碼執行。整個攻擊鏈中沒有惡意附件、沒有釣魚網址，亦沒有用戶授權對話框——接聽通話這一日常動作本身，就是攻擊面。
這大大降低了以往大多數流動漏洞仍然依賴的社會工程門檻。那些對點擊不明連結、拒絕可疑檔案格外小心的用戶，在此情況下亦無從防範，因為整個互動看起來、感覺上完全如常。
先修補後披露的時間差
Telegram 已在 Android 版 12.10.4（9 月底發布）修復該漏洞，但 NebuSec 的披露遲至 10 月 29 日才出現——中間相隔約一個月。在此期間，已發布的補丁本身已成為公開訊號：任何人將修復後的版本與前一版本對比，都有可能據此逆向推導出底層缺陷，而大多數用戶當時仍使用未修補的版本。這個時間差，正是應立即更新、而非等待獨立確認或進一步報道的最有力理據。
NebuSec 表示，該公司在修復前檢視的每一個版本均可觸發此漏洞。現有資料摘要並無 CVE 編號；讀者如需已分配的編號（如有）以及受影響版本的確切下限，應查閱 NebuSec 的完整技術報告。NebuSec 亦未說明該漏洞是透過內部研究發現，還是在實戰中觀察到遭利用；除推出補丁外，Telegram 亦未有其他公開聲明見諸報道。上述兩點實質影響用戶應以何種緊迫程度處理更新，如獲澄清則值得跟進。
目前應採取的措施
以下應對步驟相當直接，適用於任何使用受影響版本的用戶：
- 立即更新應用程式。立即從 Play Store 或貴機構的受控應用程式來源安裝 Telegram 12.10.4 或更新版本。
- 啟用自動更新 Telegram，使日後的修復無需等待手動提示即可安裝。
- 審慎處理未接通話。來自未知 Telegram 帳戶的未接通話，目前比已接聽的更安全——如你不認識來電者，在你的版本完成修補前切勿接聽。
- 限制誰可以致電你。在「設定 → 隱私與保安 → 通話」中，將來電限制為僅限聯絡人，而非所有人。
- 核查受管裝置。向員工分發手機的機構應透過 MDM（流動裝置管理）或裝置管理主控台確認已安裝的 Telegram 版本，並在可行情況下推送更新。
以上均非針對香港的特定監管應對措施，只是一般保安衛生習慣。核心要點很簡單：修補程式已經推出，披露亦已公開，更新的成本只是數分鐘；而繼續等待——面對一個能把一通電話變成遠端代碼執行的漏洞——代價則難以估計。