Signal Bug CVE-2026-113380 Could Keep Your Mic Live After You Hang Up
A RingRTC flaw rated CVSS 9.3 let a malicious Signal caller flood the call state machine so your hang-up never landed, keeping the mic and possibly the camera live. It was fixed in RingRTC 2.72.0 on September 4. Here is how to check your app.
Signal is the app I tell people to use when a conversation actually matters. So this one got my attention: a bug in Signal's calling library meant that tapping the red button did not always end the call. A malicious caller could keep your microphone, and possibly your camera, streaming to them while your screen told you the call was over.
It is tracked as CVE-2026-113380, it carries a CVSS 4.0 score of 9.3 (Critical), and it is already fixed. If your Signal app updates itself, you are almost certainly fine. If you sit on old versions, keep reading.
What went wrong
Signal's voice and video calls run on RingRTC, its open source calling library built on WebRTC. The NVD entry describes the flaw in one line: in RingRTC before 2.72.0, "a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down." The weakness is classed as CWE-754, an improper check for unusual or exceptional conditions.
The researcher's GitHub write-up explains it plainly. Your hang-up was not a kill switch. It was just one more event placed at the back of the call's finite state machine (FSM) event queue, and according to the write-up there was no rate limit on events coming from the other side and no priority lane for hang-up. The write-up's own summary: "Flood the queue with junk and the hang-up waits behind attacker noise forever, so the call (microphone, possibly camera) is never torn down."
That is a design lesson I would hand to anyone writing networked software: a control action the local user takes should never wait in line behind input from an untrusted peer.
The fix and the timeline
- September 4, 2026: Signal committed "Ensure calls terminate completely in corner cases" to RingRTC and tagged version 2.72.0 the same day. The RingRTC changelog lists that line under v2.72.0, with no mention of security. The v2.71.0 to v2.72.0 comparison is the second reference in the CVE record.
- October 20, 2026: the CVE record was published by MITRE, NVD added it, and the researcher published the write-up with a proof of concept.
So the fix shipped about six weeks before anyone talked about the bug publicly. That is how it should work.
How bad is it really?
The score is high, and the impact is real: someone hears you after you believe the call has ended. But keep it in proportion. The attacker has to be on a call with you first, which means you picked up or placed that call. CISA's enrichment on the CVE record lists exploitation as "none," and I found no report of this being used in the wild.
The proof of concept is conceptual. The researcher's poc.py is, in their words, "purely synthetic, offline, no network, no real calls, no exploit." It models a queue being flooded so a hang-up event is buried, next to a fixed version where hang-up jumps the line. It shows the pattern, not a working attack on Signal.
The 9.3 also comes from the CVE record itself (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:N/SA:N). NVD lists its status as "Awaiting Analysis," so NIST has not published its own score yet.
Are you affected?
You are affected if your Signal app bundles a RingRTC build older than 2.72.0. Signal does not print the RingRTC version in the app, so check the app version and compare it with the first releases that pull in 2.72.0 according to Signal's public source repositories (Android, iOS, Desktop):
| Platform | First app version with RingRTC 2.72.0 in source | Where to see your version |
|---|---|---|
| Android | 8.27.0 | Signal: profile picture > Help (version shown at the top), or Android Settings > Apps > Signal |
| iOS | 8.30 | Signal: Settings > Help (version shown near the bottom), or App Store > Signal |
| Desktop | 8.29.0 | Signal Desktop: Help > About Signal Desktop (on macOS: Signal > About Signal) |
- Check your version. Use the paths above. Release tags in the repositories do not always match the exact day a version hits the store, so treat these numbers as a floor, not a guarantee.
- Just update. If you are unsure, install the latest Signal from Google Play, the App Store, or signal.org. Current releases include the fix.
- Managed devices. If you run a fleet with pinned app versions, look for Signal builds older than the versions above in your MDM inventory and push the update.
- Until you have updated: after hanging up, check that the call indicator and the system mic and camera indicators are gone before you talk about anything sensitive. If in doubt, force close the app.
On Linux Desktop (Debian or Ubuntu package): check the installed package version:
dpkg -s signal-desktop | grep '^Version'Anything at 8.29.0 or later bundles the fix. Update with:
sudo apt update && sudo apt install --only-upgrade signal-desktopMy take
This is not a reason to drop Signal. The fix was quiet, early, and open for anyone to read in the commit history. It is a reason to keep auto-updates on, and a reminder that "the call ended" is something your software claims, not something you should take on faith.
Sources: NVD CVE-2026-113380, CVE record, researcher write-up and PoC, RingRTC fix commit, RingRTC changelog, Signal Android, iOS and Desktop source. First reported by SecurityWeek.
