Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls
Summary
A vulnerability in Telegram for Android allowed attackers to execute arbitrary code on a victim's device by simply answering a voice call. The issue, discovered by NebuSec, has been patched by Telegram in version 12.10.4.
IFF Assessment
This vulnerability allows for remote code execution, posing a direct threat to user security and privacy.
Severity
This vulnerability allows for remote code execution with no user interaction beyond answering a call, and has a significant impact on confidentiality, integrity, and availability. Given the attack vector and impact, a CVSS score of 9.8 (Critical) is estimated.
Defender Context
This vulnerability highlights the critical need for prompt patching of mobile applications, especially those that handle sensitive communications. Defenders should monitor for reports of successful exploitation and ensure their users are running the latest secure versions of applications.