Signal Call Flaw Could Keep Mic On After Hangup

You press the red button and the call ends. A newly published flaw in Signal’s calling code shows that it might not, and that the microphone, and perhaps the camera, could keep sending.

The bug sits in RingRTC, the open-source library Signal uses for voice and video calls. According to its CVE record, CVE-2026-113380, published by MITRE at 05:25 BST on 20 October, a peer that floods a call’s internal state-machine queue “can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down”. In plain terms, the other person on the call could stop your hangup from taking effect. Every RingRTC version before 2.72.0 is affected, and that release fixes it.

The record scores the flaw 9.3 out of 10 under CVSS 4.0, rated critical. It says the attack works over the network, needs no privileges and has low complexity, and classes the weakness as CWE-754, an improper check for unusual conditions.

No sign of attacks so far

The US Cybersecurity and Infrastructure Security Agency, which adds its own assessment to CVE records, lists exploitation as “none”. There is no known exploitation, and The Register notes that the flaw is not on CISA’s catalogue of vulnerabilities known to be exploited in the wild. The Register also reports that a conceptual proof of concept, a Python script that simulates flooding the queue, is published in a GitHub write-up.

The risk is specific. A malicious caller would have to be on the call with you already, and the outcome is that you believe the call has ended while your audio, and possibly video, carries on. That is the scenario the Register describes: “the person on the other end may think the call has been terminated, but either or both of their video and audio channels could still be open.”

The fix shipped weeks before the flaw was public

The patch is not new. The Register reports that RingRTC 2.72.0 was pushed out last month and that Signal Desktop’s release history shows it arriving in September, but that it is unclear exactly when the fixed library reached Signal’s Android and iOS apps. Signal had not responded to the Register’s questions.

By the Register’s reading of the code changes between 2.71.0 and 2.72.0, the fix lets the call’s state machine notice a hangup without waiting in the event queue, and adds a timeout so a stalled queue cannot block a hangup indefinitely.

What to do

Update Signal on every device you use it on, phone and desktop alike, to the latest version from the official app store or Signal’s website. Because the platform rollout dates are unclear, checking for updates is the only way to be sure the fix is in place. Until then, the Register’s advice is worth repeating word for word: “watch what you say after hanging up a call.”