Telegram Patches Android RCE Flaw After V12 Shows Code Execution Through a Message
Do Son 
TL;DR
Security firm V12 posted a video this week showing a Telegram Android RCE flaw in action. The firm claimed that “any telegram message can now become RCE.” Telegram quickly confirmed the issue. It said the bug in Telegram for Android “was fixed yesterday, and the fix was deployed to all users earlier today.”
V12 demonstrated remote code execution on Android through a message from a Telegram bot. Telegram says it has already fixed the flaw and pushed the update to all users. Make sure your Telegram app is up to date.
Why It Matters
Telegram is a common target because a single crafted message can reach a phone directly. Moreover, this is the second Telegram for Android code execution claim in about two weeks. On October 29, NebuSec disclosed a voice-call memory flaw fixed in version 12.10.4.
So far, V12 has not published technical details or exploit code. Instead, it posted a SHA-256 hash, a common way to prove it held the details at that time without revealing them. No CVE has been assigned, and nobody has reported attacks in the wild.
How the Attack Works
What the demo shows
The short video carries the label “Telegram Widgets RCE.” In it, a user opens a chat with a bot named v12 and sends the /start command. The bot replies with an image message. Seconds later, the phone’s Calculator app opens on its own.
Any telegram message can now become RCE
6630b003766baed1fa86cea880d22e41dc416f63d800de3246941ede2396ad48 https://t.co/YutcuqjXud pic.twitter.com/NLqRINZ0hg
— V12 (@v12sec) November 11, 2026
Launching Calculator is a classic way to prove code execution without causing harm. As a result, the demo suggests that content inside the bot’s message ran code on the device.
What remains unknown
V12 has not said which Telegram component failed, beyond the word “Widgets.” It is also unclear whether the target must interact with the message, as the demo user did by starting the bot. Likewise, the privileges the code gains on the phone remain unknown.
Affected Versions
- Telegram for Android builds released before this week’s fix
Neither Telegram nor V12 has named a vulnerable or fixed version number. Telegram also has not said whether iOS or desktop apps are affected.
Patch and Mitigation
Open Google Play or the Telegram website and install the newest Telegram for Android build. Then confirm that automatic updates are on. Until you update, avoid starting unknown bots or opening messages from strangers. Organizations should also push the update through their mobile device management tools. Because a working Telegram Android RCE demo now circulates, attackers may try to rebuild the exploit, so fast updates matter.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
