Signal bug could keep your mic - and camera - on after hangup
Careful what you say after goodbye, or better yet, update your messaging app
A vulnerability in Signal's calling library, CVE-2026-113380, could potentially keep a microphone and camera active even after a call has been ended, according to security researchers. The flaw, found in the open-source RingRTC library used by Signal, affects all versions before 2.72.0. While the update was released last month, the issue remained undisclosed until now.
RingRTC, built on WebRTC technology, handles Signal's calling functionality, but it has failed to properly end calls due to an overload of requests in its finite state machine (FSM) event queue. This could result in a denial-of-service attack, leaving the call's audio and video channels open. Signal has since addressed the vulnerability in version 2.72.0 by improving the FSM's ability to detect termination requests independently of the event queue, and adding a timeout to prevent stalled processing.
Users are advised to update their Signal apps immediately to avoid any unwanted surprises after ending a call.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
- Signal bug could keep your mic - and camera - on after hangup theregister.com
