Signal bug could keep your mic - and camera - on after hangup

A security flaw, known as CVE-2026-113380, discovered in Signal's calling library could cause an ongoing issue after a call has been terminated. The vulnerability, identified by MITRE and rated with a high CVSS score of 9.3, affects all versions of Signal prior to 2.72.0. This flaw is due to a weakness in RingRTC, the proprietary calling library developed by Signal, which is built upon WebRTC technology.

RingRTC, which manages the call events, utilizes a finite state machine (FSM) to handle the call processes. However, when an event queue is overwhelmed by excessive requests, it might fail to process a hangup request, leaving the call active - a type of denial-of-service attack. This issue can leave audio and video channels open even after a call has been hung up, potentially causing unintended exposure.

Although there isn't any evidence of this vulnerability being exploited in the wild, it is strongly advised that Signal users update their applications on all platforms, including mobile, desktop, to the latest versions to prevent any potential issues. Signal's own release history indicates that the updated version of RingRTC was integrated in September, but the exact rollout dates across all platforms remain unidentified.

Signal has been contacted for further clarification, but no response has been received at the time of writing.