A serious bug in Signal’s voice and video calling software could let a bad caller block the end of a call. The other person may think the chat is over. Their microphone, however, could stay on.
Tracked as CVE-2026-113380, the flaw sits in RingRTC, Signal’s open-source calling library. A library is a bundle of code that an app uses to do a job. The flaw went public on October 20, 2026. It earned a CVSS score of 9.3 out of 10, which puts it in the critical range.
CVSS is a system that rates how dangerous a flaw is. The top score is 10, so 9.3 sits near the very top. A CVE is a public ID for a known security flaw. It helps people find the same bug across different records. According to the published details, the issue affects RingRTC versions earlier than 2.72.0. Signal’s developers fixed it in that version.
Bug lets a caller keep listening after the hang-up
Reports say the bug could let one caller keep hearing audio after the other person tries to hang up. The published description also warns that video could stay on. Still, the exact conditions and the length of any extra streaming remain unclear.
Reports on October 21 covered the flaw. The trouble comes from another person on the call, who sends a flood of requests. Everything starts with how RingRTC handles call events. The library uses a finite state machine, or FSM, to run each stage of a call. That includes the steps needed to end it.
Think of the FSM’s event queue as a line at a shop counter. Each request waits for its turn. A bad caller can flood that line with requests. A full queue simply holds more requests than it can handle at once. When the line gets full, RingRTC may miss the local hang-up request. The call then fails to shut down as planned.
As a result, a user may believe the call is over while audio stays on. Video could stay on too. Sounds and talk near the device could keep reaching the other caller, and the user would not know. That creates a real privacy risk.
The flaw falls under CWE-754, which covers poor checks for unusual or rare conditions. The trouble lies in ending calls. It does not involve Signal’s message encryption. The issue concerns call termination, which is the moment a call ends. Reports also say the bug alone does not point to hacked accounts, stolen passwords, or exposed message histories.
Version 2.72.0 brings stronger hang-up handling
The RingRTC project fixed the issue in version 2.72.0. A comparison of versions 2.71.0 and 2.72.0 shows changes that make call endings more reliable. One change handles hang-up requests apart from the event queue. That keeps them out of the crowded line.
Another change adds a timeout, which is a time limit. It stops a stalled process from blocking a hang-up forever. Without that limit, one stuck task could hold up the whole hang-up step. Together, the two changes target the weak spot the flaw exposes.
A republished advisory, based on details from Italy’s cybersecurity incident response community, names RingRTC versions before 2.72.0 as affected. It also lists three Signal apps, one for each kind of device. Android versions before 8.27.0 are affected. So are iOS versions before 8.30.0 and Desktop versions before 8.29.0.
However, reports say Signal has not publicly confirmed the affected and first fixed app versions in the sources reviewed. Users should therefore install the latest official update. Those version numbers alone are not enough to rely on.
Other public records also list the flaw. The CIRCL vulnerability database carries an entry for it, and a notes page on GitHub covers the same CVE. The CVE record, the version comparison, and the code changes are all open for anyone to read.
No attacks reported, but Signal users should update now
No confirmed public evidence shows that attackers have used CVE-2026-113380 in real attacks. The critical rating describes how severe the flaw could be. It does not prove that widespread attacks have happened. In the wild means in real attacks outside of testing. So far, no confirmed public record shows that kind of use.
Signal users should update the app on every device they use. That includes phones and desktop computers. The advisory lists Android, iOS, and Desktop apps separately, so each one needs the newer version. Until the update arrives, users should be careful about sharing sensitive details during calls with contacts they do not trust.
Users who rely on Signal for private talks should treat updates as part of staying safe. The case teaches a clear lesson about private chats. Encrypted communication still depends on the software that manages calls and devices. Strong encryption cannot fully protect privacy if a calling app fails to end a session when the user expects it to.
Signal is also expanding its privacy protections for stored data, including encrypted iPhone backups, as it continues to address the challenges of keeping users’ communications private.
