Signal bug could keep your mic - and camera - on after hangup
Careful what you say after goodbye, or better yet, update your messaging app
A security flaw in Signal's encrypted calling library, RingRTC, may leave audio and video streams active even after a call has been ended. The vulnerability, CVE-2026-113380, was disclosed on Tuesday and affects all versions of RingRTC prior to 2.72.0, which was released last month. The issue lies within RingRTC's finite state machine (FSM) event queue, which handles call management events.
By flooding the queue with requests, one party on the call can overwhelm the system and prevent a hangup request from being processed. This could result in a denial-of-service attack, leaving the call open and potentially exposing users to eavesdropping. The problem is classified as CVE-2026-113380, with a critical CVSS score of 9.3.
Signal has not publicly confirmed when the fix was rolled out across all platforms, but users are advised to update their apps as soon as possible to avoid any potential issues.
Written by urgent.news from The Register Software's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
- Signal bug could keep your mic - and camera - on after hangup theregister.com
