Plan
active
Telegram Android RCE Triggered by Answering Voice Calls, Patched in v12.10.4
- Engineer — Plan: One-interaction RCE requiring only an attacker Telegram account is a high-severity mobile risk; verify corporate or BYOD devices are running Telegram ≥ 12.10.4 via MDM policy or device-compliance checks. No exploitation signals yet, so this is a patch-window item rather than emergency.
- SOC/IR — Learn: No active exploitation, IOCs, or ATT&CK-mappable TTPs have been published; the voice-call RCE vector is worth logging for context when triaging future mobile-related incidents, but there is nothing actionable to detect or hunt today.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.