Signal Bug Let Callers Keep Listening After Hang-Up
In short: On October 20, 2026, a critical vulnerability — CVE-2026-113380, CVSS 9.3 — was disclosed in RingRTC, the library that powers Signal's audio and video calls. A malicious caller could deliberately flood the call's command queue so that the local "hang up" action on your side stalled, leaving your microphone — and in some scenarios your camera — still transmitting after the screen showed the call had ended. The flaw was already patched in September 2026, so the risk only applies to outdated apps. If you haven't updated Signal since summer, now's the time — see our breakdown of messenger privacy trade-offs in what a messenger can and can't see about you.
What happened
MITRE published the CVE-2026-113380 record on October 20, 2026, with a CVSS 4.0 score of 9.3 — a "critical" rating. The flaw sits in RingRTC, the open-source calling library behind Signal's voice and video calls on Android, iOS, and Desktop. It's classified as CWE-754 (improper handling of exceptional conditions) and was fixed in RingRTC version 2.72.0, released in September 2026 — meaning public disclosure came after the patch was already out.
How the attack works
RingRTC calls run through an internal finite-state-machine (FSM) event queue. A call participant could intentionally saturate that queue with a flood of signaling events, creating a bottleneck: the local hang-up command — the one triggered by tapping "end call" — got stuck behind junk events and failed to process in time. The result: the media stream (audio, and in some cases video) kept reaching the other participant even after the user's screen showed the call had ended. A working proof-of-concept, roughly 60 lines of Python, is public on GitHub, and exploitation is rated as low-complexity. According to CISA, no in-the-wild exploitation had been documented as of publication.
Who's affected
At risk are users on outdated app versions: Signal for Android before 8.27.0, Signal for iOS before 8.30.0, and Signal Desktop before 8.29.0. Every current build released after the September RingRTC patch closes the hole. Signal is widely regarded as one of the most privacy-hardened messengers specifically because of end-to-end encryption — this case is a reminder that channel encryption doesn't help if the on-device call-handling code itself is vulnerable.
Why this is worse than an ordinary DoS
Technically, the attack mechanism is a denial-of-service against local control signals, but the consequences go well beyond a frozen interface. The victim sees the call end on screen and behaves accordingly — speaking near the microphone, moving back into the camera's view, going about their business — unaware that data transmission never actually stopped. That's a textbook covert surveillance scenario: the threat isn't broken encryption, it's manipulating app state that the user trusts to mean "this call is over." We cover the same "trust the screen, not the actual state" problem from the VPN side in our guide to what actually makes a VPN secure.
What to do right now
- Check your Signal version in the App Store, Google Play, or on the official site, and update to at least Android 8.27.0, iOS 8.30.0, or Desktop 8.29.0.
- Turn on auto-updates for messaging apps — critical patches like this one close the exposure window fastest that way.
- After sensitive calls, don't rely solely on the "call ended" screen — physically close the app, or check your OS's microphone/camera activity indicator in the status bar, which lights up even if the app claims the call is over.
- If you administer devices or handle sensitive calls over public or untrusted Wi-Fi, an encrypted tunnel like LiMP VPN closes a separate risk — traffic interception in transit — but it doesn't substitute for updating the app itself, which is what actually closes this vulnerability.
Sources
Frequently asked questions
Do I need to do anything if I haven't updated Signal in a while?
Yes — update to Android 8.27.0, iOS 8.30.0, or Desktop 8.29.0 or later. The fix shipped in RingRTC 2.72.0 (September 2026); earlier app versions remain exposed.
Does this mean Signal's end-to-end encryption is broken?
No. The underlying protocol encryption itself isn't affected — the bug is in how the hang-up command is processed client-side (the RingRTC library), which let the media stream outlast what the user expected.
Will a VPN protect against this vulnerability?
No, a VPN doesn't fix the vulnerability itself — that requires updating the app. A VPN addresses a separate risk: traffic interception during calls over public or untrusted Wi-Fi, which is unrelated to CVE-2026-113380 directly.