NebuSec xavfsizlik startapi ma'lumotiga ko'ra, Telegram Android ilovasidagi xato hujumchiga jabrlanuvchining telefonida kodni ishga tushirishga imkon bergan — bu jabrlanuvchi ovozli qo'ng'iroqqa javob berganidan keyin sodir bo'lgan.
Hujumchiga faqat oddiy Telegram akkaunti kerak bo'lgan. Telegram ilovaning 12.10.4 versiyasida, sentyabr oxirida chiqarilgan versiyada, bu xatoni tuzatgan va NebuSec uni 29-oktabrda oshkor qilgan.
NebuSec asoschisi va bosh direktori The Hacker News'ga yuborgan elektron pochta xabarida aytishicha, bu xato 8.6.2 dan 12.10.3 gacha bo'lgan har bir versiyada ishga tushishi mumkin. Bu versiyalar 2022-yil martidan 2026-yil sentyabrigacha chiqqan.
Kompaniya bu xatoni ARM64 asosidagi telefonlarda shaxsiy telefon qo'ng'iroqlari orqali tasdiqlagan va hozircha Telegram'ning iOS va ish stoli ilovalariga yoki guruh qo'ng'iroqlariga to'g'ridan-to'g'ri ta'sir qilishi haqida dalil yo'q.
Telegram Android'dan foydalanadigan har bir kishi ilova 12.10.4 yoki undan keyingi versiyada ekanligiga ishonch hosil qilishi kerak. Versiya raqami ilovaning Sozlamalar sahifasi pastida ko'rinadi. 29-oktabr holatiga ko'ra, bu xato CVE identifikatoriga ega emas edi.
The Hacker News NebuSec va Telegram'dan bu xato haqiqiy hujumlarda ishlatilganmi yoki yo'qmi, shuningdek NebuSec'dan hujumchining kodi telefonda nimaga erishishi mumkinligi haqida so'ragan.
Telegram qo'ng'irog'i davomida ikkita ilova bir-biriga qo'ng'iroqni o'rnatish va uning holatini xabar qilish uchun qisqa xabarlar yuboradi. MediaState deb ataladigan bir tur mikrofon o'chirilganmi, kamera yoqilganmi va video qanday aylantirilganini xabar qiladi.
Xato MediaState xabarlarini o'qiydigan kodda bo'lgan. Bu kod yo'qolgan maydonlarni to'g'ri ishlamagan va kirishi kerak bo'lmagan xotiraga kirgan, deb aytgan NebuSec.
The Hacker News tomonidan 12.10.3 versiyasi uchun Telegram'ning e'lon qilingan manba kodini ko'rib chiqish natijasida bu tavsifga mos keladigan xato topilgan. MediaState xabari aylanish qiymatini o'z ichiga olganida, kod bu qiymatni tekshirgan. Keyin u boshqa maydonni — video holatini — hatto xabarda bunday maydon bo'lmasa ham o'qigan.
12.10.4 versiyasi aylanish qiymatini to'g'ri maydondan o'qiydi. Bu xabarni ishlatadigan chaqiruv kodi 8.6.2 versiyasida yoqilgan — bu NebuSec nomlagan birinchi versiya.
Telegram'ning Android, iOS va ish stoli ilovalari qo'ng'iroqlar uchun tgcalls deb ataladigan bitta umumiy kutubxonadan foydalanadi. "Kamera aylanishini tuzatish" deb nomlangan o'zgarish 2026-yil 21-aprelda tgcalls'da xuddi shu tuzatishni amalga oshirgan.
Telegram'ning iOS manba kodi bu o'zgarishni may oyida chiqarilgan 12.7 versiyasidan, ish stoli ilovasi kodi esa iyulda chiqarilgan 7.0.1 versiyasidan o'z ichiga olgan. Telegram Android bu tuzatishni sentyabrda 12.10.4 versiyasida olgan.
Oldingi kod bu ilovalarda ishlatilishi mumkinligi ko'rsatilmagan.
NebuSec videosida ikkita telefon ko'rsatilgan — biri hujumchi, biri jabrlanuvchi sifatida belgilangan. Jabrlanuvchi Telegram qo'ng'irog'iga javob beradi. Qo'ng'iroq boshlanganidan taxminan yarim daqiqa o'tgach, jabrlanuvchining telefoni uy ekraniga o'tadi, ilova piktogrammalari ekranda pastga tushadi va "HACKED BY NEBUSEC" logotipi paydo bo'ladi.
Video jabrlanuvchining telefoni qaysi Telegram yoki Android versiyasida ishlayotganini ko'rsatmaydi. 29-oktabr holatiga ko'ra NebuSec veb-saytida bu xato haqida texnik yozuv yo'q edi, shuning uchun xatodan kodni ishga tushirishgacha bo'lgan qadam video va kompaniya aytganlarga bog'liq.
Y Combinator tomonidan qo'llab-quvvatlanadigan startap NebuSec o'zining Code Security mahsuloti — OpenAI'ning GPT-5.4 modelida ishlaydigan — bu xatoni topganini aytadi. Iyul oyida kompaniya Android 17 ishlaydigan ARM64 qurilmasining yadrosiga yetib boradigan Firefox xatosi bilan boshlanadigan Android ekspluatatsiya zanjirini tasvirlagan.
Alohida, Zero Day Initiative (ZDI) 15-oktabrda Telegram ilovalari animatsiyali stikerlarni chizish uchun ishlatib kelgan rlottie kutubxonasidagi tuzatilmagan xato haqida maslahat e'lon qilgan. CVE-2026-111105 (CVSS balli: 7.0) deb kuzatiladigan bu xato, agar foydalanuvchi zararli fayl yoki sahifani ochsa, hujumchiga kodni ishga tushirishga imkon beradi, deb aytgan ZDI.
Telegram mart oyida ZDI'ga serverlardagi tekshiruvlar bu xatoni yumshatganini aytgan va aprelda ZDI'dan to'liq masofaviy kodni ishga tushirish zanjirini so'ragan.
Bu tekshiruvlar aylanib o'tilishi mumkin, deb aytadi tadqiqotchi Saifeldeen Aziz Tokiodagi OffensiveCon nutqining abstraktida. Tadqiqot AI yordamida fuzzing — kodga katta miqdorda buzilgan yoki kutilmagan ma'lumot berish — yordamida Telegram'ning iOS, Android va ish stoli ilovalarida rlottie'dagi xotira buzilish xatolarini topgan. Keyin u bu xatolarni — stikerlar yetkazilishi va tekshirilishidagi kamchiliklardan kelib chiqqan — zanjir qilib, Telegram iOS'da kodni ishga tushirgan.
Android ilovasi Telegram'ning e'lon qilingan manba kodiga ko'ra, iyundagi 12.8.1 va avgustdagi 12.10.0 versiyalari orasida rlottie'ni Rust'da yozilgan tlottie kutubxonasi bilan almashtirgan. Ish stoli ilovasi kodi sentyabrda xuddi shu almashtirishni amalga oshirgan va iOS kodi oktyabrda 13.0 versiyasida tlottie'ni qo'shgan, lekin hali ham rlottie'ni o'z ichiga olgan.
A flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec.
The attacker needed only an ordinary Telegram account. Telegram fixed the flaw in version 12.10.4 of the app, released in late September, and NebuSec disclosed it on October 29.
The flaw can be triggered in every version from 8.6.2 through 12.10.3, NebuSec's co-founder and chief executive said in an email to The Hacker News. Those versions came out between March 2022 and September 2026.
The company confirmed it in private phone calls on ARM64-based phones and has no evidence so far that it directly affects Telegram's iOS and desktop apps or group calls.
Anyone using Telegram for Android should make sure the app is on version 12.10.4 or later. The version number appears at the bottom of the app's Settings page. The flaw had no CVE identifier as of October 29.
The Hacker News has asked NebuSec and Telegram whether the flaw was used in real attacks, and asked NebuSec what an attacker's code could reach on a phone.
During a Telegram call, the two apps send each other short messages to set up the call and report its state. One type, called MediaState, reports whether the microphone is muted, whether the camera is on, and how the video is rotated.
The flaw was in the code that reads MediaState messages. That code did not handle missing fields correctly and accessed memory it should not, according to NebuSec.
Telegram's published source code for version 12.10.3 contains a flaw that matches that description, a review by The Hacker News found. When a MediaState message included a rotation value, the code checked that value. It then read a different field, the video state, even if the message had no such field.
Version 12.10.4 reads the rotation value from the right field. The calling code that uses this message was switched on in version 8.6.2, the first version NebuSec names.
Telegram's Android, iOS, and desktop apps use one shared library, called tgcalls, for calls. A change labeled "Fix camera rotation" made the same correction in tgcalls on April 21, 2026.
Telegram's iOS source code included that change from version 12.7, released in May, and the desktop app's code from version 7.0.1, released in July. Telegram for Android received it in version 12.10.4 in September.
Whether the earlier code could be exploited in those apps has not been shown.
NebuSec's video shows two phones, one marked as the attacker and one as the victim. The victim accepts a Telegram call. About half a minute into the call, the victim's phone switches to its home screen, the app icons fall down the screen, and a "HACKED BY NEBUSEC" logo appears.
The video does not show which Telegram or Android version the victim's phone was running. No technical write-up of the flaw was on NebuSec's website as of October 29, so the step from the flaw to running code depends on the video and on what the company says.
NebuSec, a startup backed by Y Combinator, says its Code Security product, which runs on OpenAI's GPT-5.4 model, found the flaw. In July, the company described an Android exploit chain that started with a Firefox flaw and reached the kernel of an ARM64 device running Android 17.
Separately, the Zero Day Initiative (ZDI) published an advisory on October 15 about an unpatched flaw in rlottie, the library Telegram apps have used to draw animated stickers. The flaw, tracked as CVE-2026-111105 (CVSS score: 7.0), can let an attacker run code if a user opens a malicious file or page, ZDI said.
Telegram had told ZDI in March that checks on its servers mitigated the flaw, and in April asked ZDI for a full remote code execution chain.
Those checks could be bypassed, researcher Saifeldeen Aziz says in the abstract for his OffensiveCon talk in Tokyo. The research used AI-guided fuzzing, which feeds code with large amounts of broken or unexpected input, to find memory-corruption bugs in rlottie across Telegram's iOS, Android, and desktop apps. It then chained those bugs, which stem from flaws in how stickers are delivered and checked, to run code on Telegram for iOS.
The Android app replaced rlottie with tlottie, a library written in Rust, between versions 12.8.1 in June and 12.10.0 in August, according to Telegram's published source code. The desktop app's code made the same switch in September, and the iOS code added tlottie in version 13.0 in October while still including rlottie.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.