Signal Hang-Up Bug: Callers Could Keep Listening

A Signal hang-up bug (CVE-2026-113380, severity 9.3) could let a caller keep hearing you after you hung up — Signal patched it in September, so update your app now.

What Happened: The Call That Never Ended

Signal is the messaging app people reach for when privacy really matters — journalists, activists, and anyone who wants their calls locked down with end-to-end encryption. So when a security researcher disclosed a flaw this week that let a caller keep your microphone and camera running after you pressed "end", it made headlines fast.

Image: Signal

The flaw, tracked as CVE-2026-113380, earned a severity score of 9.3 out of 10 — the "critical" bracket. It lives in RingRTC, the open-source library that powers Signal's voice and video calls on Android, iPhone, iPad, and desktop (it is built on WebRTC, the same real-time communication technology behind many video-call services). Any RingRTC version before 2.72.0 was vulnerable, and Signal shipped the fix in RingRTC 2.72.0 on September 4 — though the details, and a proof-of-concept demonstration, only became public on October 20.

There is no sign anyone actually exploited the bug in the wild, and it is not listed in CISA's catalog of known exploited vulnerabilities. But now that the details are public, keeping an old version of Signal installed is a needless risk. For the latest on threats like this one, see our more cybersecurity news coverage.

How the Signal Hang-Up Bug Worked

Here is the simple version of a subtle technical flaw. Inside RingRTC, every call is managed by what programmers call a finite state machine with an event queue — picture it as a to-do list the app works through: "start the call," "send audio," "receive audio," and eventually, "end the call."

The problem: pressing "end call" did not act like a kill switch. It was just one more item added to the back of the queue. And the remote caller faced no speed limit on how many of their own events they could pile onto that queue. So a malicious caller could flood the queue with junk, and your hang-up request would wait behind the noise forever — the call simply never tore down.

Image: Signal

As the researcher's write-up put it: "Flood the queue with junk and the hang-up waits behind attacker noise forever, so the call (microphone, possibly camera) is never torn down." From your side, everything looked finished. Underneath, the audio channel — and possibly video — kept flowing to the person you just said goodbye to.

Two things made this especially nasty:

• It was easy to pull off. The attack complexity is officially rated low. All the attacker needed was to be a participant on a normal call with you — no special access to your phone, no stolen passwords.
• It was hard to notice. Your call screen showed the call as ended. Unless you glanced at your phone's microphone or camera indicator, you had no reason to suspect anything was still streaming.

The one big limit

There is an important caveat: the attacker had to be on the call with you. A stranger could not use this flaw to tap into conversations they were never part of. The risk was someone you had actually called or accepted a call from — which is also why it is worth thinking twice about unknown callers until your apps are up to date.

What Was at Risk — and What Was Not

The most surprising detail: Signal's encryption was never broken. The bug was not about reading your messages or cracking the cryptography. It was about the moment after goodbye. Here is the clear split:

• At risk: an open microphone could pick up an offhand remark, a conversation with someone nearby, or private background sound you would never share on purpose. Possibly the camera feed too.
• Not at risk: no passwords were stolen, no accounts were compromised, no message history was exposed — and nobody needs to reset anything. As Malwarebytes pointed out, the flaw never touched how Signal encrypts conversations.

It is the same category of harm as the recent Meta Muse zero-day that hijacked dictation: the microphone stays live when the person holding the phone believes it is off. Nothing failed except the one thing people assume without thinking — that a call is over when they hang up.

Protect Yourself: Update Signal on Every Device

The fix is already out and the action you need to take is simple. Signal changed its call code so that hang-up requests are detected independently of the event queue — they can no longer get stuck behind attacker noise — and added a timeout so a stalled hang-up cannot block the call from ending.

• Update Signal everywhere. Phone and desktop and tablet — they update separately. A desktop app left open for weeks may only need a restart to install the pending update. One independent review of Signal's public source code found the fix in Android 8.27.0 and later, iPhone and iPad 8.30 and later, and Desktop 8.29.0 and later — but since Signal has not published an official per-version list, the safest rule is: update everything to the newest version.
• Check your indicators after calls. On Android and iPhone, a dot or icon at the top of the screen shows when your microphone or camera is active. After hanging up a Signal call, make sure those indicators disappear. If they do not, revoke Signal's camera and microphone access in your system settings.
• Keep auto-updates on. The flaw sat quietly in code for years; the fix shipped weeks before anyone knew about it. Phones that install updates automatically were already protected. See our technology coverage for more on keeping your apps and devices current.
• Be cautious with unknown callers. Since the attacker must be a participant on the call, calls from unknown numbers deserve a bit more care until you are sure every device is patched.

The encryption held the whole time. What failed was a design assumption buried deep in the code — that "end call" means the call ends. Signal fixed the bug; the rest is on you to tap update.

Sources: SecurityWeek, Cyberpresso, Privacy Guides, SecurityOnline, Neotech Cloud Solutions