A dangerous vulnerability was discovered in Signal that could allow the other person on a call to continue hearing the user even after the call had ended. The flaw could also potentially leave the camera active, even though the user believed the conversation was over.
A critical vulnerability, CVE-2026-113380, was discovered in RingRTC, the library responsible for voice and video calls in Signal. The flaw affected all versions of the library prior to 2.72.0 and could prevent a call from being fully terminated, even after the user pressed the hang-up button.
The vulnerability was disclosed by MITRE, the organization that maintains the Common Vulnerabilities and Exposures (CVE) database. The flaw received a CVSS score of 9.3, indicating a critical severity level.
According to MITRE’s description, the issue could be triggered by overwhelming the event queue of the call’s finite state machine (FSM). This mechanism manages the different stages of a call, including establishing and terminating the connection.
“In Signal’s RingRTC library prior to version 2.72.0, a call participant who overwhelms the FSM queue can prevent local call termination from fully disconnecting the connection, including the audio stream and potentially the video stream,” MITRE’s description states.
In practice, one participant could create conditions in which pressing the hang-up button would not properly close the connection. As a result, the audio stream, and potentially the video stream, could remain active.
This meant that a user could continue a private conversation or go about other activities without realizing that their microphone was still transmitting audio.
The main danger of CVE-2026-113380 was the possibility of unauthorized eavesdropping after a user believed a call had ended. The technical description also mentioned the possibility of the video stream remaining active.
However, researchers did not specify how this situation would appear on the device’s screen. In particular, it remains unclear whether users would see an active microphone or camera indicator, or how long audio or video transmission could continue after an attempt to end the call.
Importantly, the flaw did not involve breaking Signal’s end-to-end encryption. Messages and calls remained protected by the messenger’s cryptographic mechanisms, while the vulnerability itself was related exclusively to the improper termination of a connection.
There is also no evidence that the flaw could be used to steal passwords or gain control of a Signal account. At the time of disclosure, no confirmed cases of the vulnerability being exploited in real-world attacks had been reported.
Developers addressed the issue in RingRTC version 2.72.0. The library update was released in September 2026, although information about the vulnerability was not made public until October.
According to the RingRTC code changes on GitHub, the fix allowed the FSM call management mechanism to detect requests to terminate a connection independently of the event queue.
Developers also introduced a timeout mechanism to prevent stalled processes from indefinitely blocking call termination. As a result, calls should now end properly even when the processing of other events is delayed.
RingRTC is an open-source library that powers Signal’s voice and video calling functionality. Its components are used in both mobile and desktop versions of the messenger, meaning the flaw affected an important part of its communications infrastructure.
Signal remains one of the best-known messaging apps focused on privacy and secure communication. However, this incident demonstrates that even strong end-to-end encryption cannot protect against flaws in call management mechanisms.
Users are advised to install all available Signal updates on their devices. The vulnerability has already been fixed, and there is no confirmed evidence of attackers exploiting it. Nevertheless, keeping the app up to date remains the simplest way to avoid the potential risk of being eavesdropped on after ending a call.
