Vulnerabilities · Application Security · Privacy
Signal bug could let others keep listening after you hang up
A flaw in Signal’s calling library could let someone keep hearing or seeing you after you hang up. Users should update their apps to stay protected.
Ross GrantUpdated 2 min read
The short version
A bug in Signal’s call software could let someone keep hearing or seeing you after you hang up. The problem is with how the app ends calls, not with its encryption. If someone exploits this, your microphone or camera could stay on without you knowing. Updating your Signal app should protect you.
By the numbers
- 9.3CVSS score for the vulnerabilityMalwarebytes
- 2.72.0First fixed version of RingRTC libraryMalwarebytes
- 8.27.0Signal for Android versions before this are affectedSecurity Affairs
- 8.30.0Signal for iOS versions before this are affectedSecurity Affairs
- 8.29.0Signal Desktop versions before this are affectedSecurity Affairs
What happened?
A critical bug in Signal’s calling library could let someone keep listening or watching after you hang up a call. The flaw, tracked as CVE-2026-113380, affects RingRTC versions before 2.72.0. Updates are available, but the exact rollout dates for all platforms are unclear. There are no reports of real-world exploitation so far.
How the flaw works
A critical vulnerability (CVE-2026-113380, CVSS 9.3) has been found in Signal’s open-source calling library, RingRTC, which is used for voice and video calls in the Signal app. According to Malwarebytes (opens in a new tab), The Register (opens in a new tab), and Security Affairs (opens in a new tab), the flaw affects RingRTC versions before 2.72.0. The issue is not with Signal’s encryption, but with how the app ends calls.
When a user hangs up, the command to end the call is placed in an internal event queue managed by a system called a finite state machine (FSM). If a malicious participant floods this queue with events, the hang-up request can be delayed or ignored. This means the microphone, and possibly the camera, could stay active after the user thinks the call has ended. The technical report on GitHub shows a proof of concept using a Python script to simulate this event flooding.
Who is affected
The flaw affects anyone using Signal apps that include a vulnerable version of RingRTC. According to a CSIRT Toscana advisory cited by Security Affairs (opens in a new tab), the affected app versions are:
- Signal for Android before 8.27.0
- Signal for iOS before 8.30.0
- Signal Desktop before 8.29.0
It is not clear from public sources exactly when the fixed versions were rolled out across all platforms, but updates are available.
What was taken
No passwords, message histories, or accounts are exposed by this bug. The risk is that someone could keep listening to your microphone (and possibly see your camera feed) after you hang up, capturing private conversations or background sounds you did not intend to share.
Is there a fix?
The vulnerability is fixed in RingRTC version 2.72.0. Signal’s developers updated the code so that hang-up requests are handled more reliably, even if the event queue is full. Users are advised to update their Signal app to the latest version on all devices. The fix is available, but the exact app versions containing the patch are not fully confirmed in public sources. Users should check for updates in their app store and install them promptly.
The response
There are no reports of this flaw being exploited in the wild. The issue was disclosed publicly after the fix was released. Signal has not yet published a detailed statement or confirmed the rollout dates for all platforms. Researchers recommend updating immediately, especially for those who use Signal for sensitive conversations.
Why it matters
This bug could let someone secretly listen or watch after a call ends, putting private conversations at risk. It shows that even secure apps can have flaws unrelated to encryption. Users should update Signal to stay protected.
Key points
- Signal’s calling library had a flaw that could keep your mic or camera on after hang-up.
- The issue affects RingRTC versions before 2.72.0, used in Signal apps.
- Attackers could flood the event queue to delay or block call termination.
- No passwords or messages were exposed, but private audio or video could be captured.
- Updating Signal to the latest version fixes the problem.
Sources
Malwarebytes
Reference
The Register
Reference
Security Affairs
Reference