Security News

Critical Signal Calling Flaw Could Leave Microphones and Cameras Live After a Call Ends

The Register · 22 Oct 2026

Key Takeaway Update Signal on every phone and computer your staff use to the latest version now, and make app updates a routine part of your device management.

A critical vulnerability in Signal's calling library could let a call stay open after one person hangs up. Tracked as CVE-2026-113380 and rated 9.3 on the CVSS scale, the flaw affects every version of the open-source RingRTC library before 2.72.0. That update was released last month, but the details were only made public this week, when MITRE published the CVE.

RingRTC is Signal's own calling library, built on WebRTC, a widely used technology for internet voice and video that already encrypts media traffic. The problem lies elsewhere. According to the CVE report, a participant on a call can flood the event queue that manages call activity. If the queue is overwhelmed, it may fail to process a hangup request, so the call does not terminate. The flaw is classed as CWE-754, improper checking for unusual or exceptional conditions.

If exploited, the other person may believe the call has finished while their audio, video, or both remain open. The CVE rates the attack complexity as low. A conceptual proof of concept is described in a GitHub report. CISA's known exploited vulnerabilities catalog does not currently indicate that the flaw has been seen in the wild. Signal users should make sure both their mobile and desktop apps are updated to the latest versions.

Signal CVE-2026-113380 Vulnerability Messaging Security Patch Management

Summarised by CISO AI from The Register, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.