Critical Signal Vulnerability Could Keep Your Mic and Camera Live Even After Hang Up

A critical vulnerability in Signal’s calling library could allow a malicious call participant to keep hearing audio after another user tries to hang up.

The flaw, tracked as CVE-2026-113380, affects RingRTC versions before 2.72.0 and carries a CVSS severity score of 9.3. Video could also remain active, although the published description does not confirm that behavior.

RingRTC powers Signal’s voice and video calling features across its mobile and desktop apps. The issue affects how calls shut down, not how Signal encrypts conversations. A secure connection can still carry private audio if the software fails to close it when the user presses the end-call button.

The problem involves an internal event queue used by RingRTC’s finite-state machine, or FSM. This component tracks a call’s state and handles instructions that control its operation. A malicious participant can overwhelm the queue and interfere with the steps needed to end the call.

Signal Vulnerability

According to Imahian’s GitHub vulnerability description, a remote peer can saturate the event queue and prevent a local hang-up from fully ending the call, potentially leaving audio accessible to the other participant after the user believes the conversation has ended.

The attack requires a malicious participant in a call. It is not described as a way for an unrelated outsider to switch on any Signal user’s microphone.

Available reporting also leaves important details unresolved, including what affected users would see onscreen and how long unwanted transmission might continue.

The Python demonstration simulates how queued events can block hang-up handling but runs offline and does not attack Signal or prove real-world exploitation.

The fix makes call termination less dependent on the overloaded event queue. RingRTC 2.72.0 introduces a separate termination flag that call and connection state machines can check independently. It also adds five-second limits to shutdown waits, allowing cleanup to continue when individual steps fail.

The patch analysis describes tests covering full queues and failed application notifications. They check that hang-up closes the simulated connection, turns off outgoing audio, and clears the component handling outgoing media packets. The change strengthens shutdown behavior rather than replacing Signal’s encryption.

Signal users should install available updates on every phone and computer they use. Developers building applications with RingRTC should use version 2.72.0 or later.

However, the reviewed reports do not establish the first fixed Signal app version for every platform, so the library version should not be presented as an app version.

This flaw differs from previously reported Signal linked-device attacks, which targeted account access, and Signal support impersonation campaigns, which tricked users into sharing registration details. Those incidents used different attack methods, not this call-shutdown failure.

The reviewed coverage reported no known exploitation. Even so, the potential exposure matters for sensitive calls. Updating addresses the underlying software risk, while checking that call and microphone indicators have stopped provides an additional practical precaution before discussing private information nearby.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.