{
  "id": 15921634,
  "title": "Signal bug could keep your mic - and camera - on after hangup",
  "url": "https://urgent.news/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup-15921634",
  "topic": "science",
  "section": "Science",
  "published": "2026-10-21T17:00:58.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528"
  },
  "original_language": "en",
  "account": "A vulnerability in Signal's calling library, CVE-2026-113380, could potentially keep a microphone and camera active even after a call has been ended, according to security researchers. The flaw, found in the open-source RingRTC library used by Signal, affects all versions before 2.72.0. While the update was released last month, the issue remained undisclosed until now. RingRTC, built on WebRTC technology, handles Signal's calling functionality, but it has failed to properly end calls due to an overload of requests in its finite state machine (FSM) event queue. This could result in a denial-of-service attack, leaving the call's audio and video channels open. Signal has since addressed the vulnerability in version 2.72.0 by improving the FSM's ability to detect termination requests independently of the event queue, and adding a timeout to prevent stalled processing. Users are advised to update their Signal apps immediately to avoid any unwanted surprises after ending a call.",
  "summary": "Careful what you say after goodbye, or better yet, update your messaging app",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Register Software",
        "title": "Signal bug could keep your mic - and camera - on after hangup",
        "url": "https://urgent.news/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup",
        "published": "2026-10-21T17:00:58.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}