Signal call bug could leave audio active after hang-up
Summary
CVE-2026-113380 affects RingRTC versions before 2.72.0 and could let a call participant keep hearing audio after hang-up. No in-the-wild exploitation is known; users are advised to update Signal.
Key points
- CVE-2026-113380 has a CVSS score of 9.3 and affects RingRTC versions earlier than 2.72.0.
- A call participant could overwhelm an internal event queue and interfere with call disconnection, potentially leaving audio available after hang-up.
- The flaw concerns call shutdown, not conversation encryption; the article says it does not expose passwords, accounts, or message histories.
- The vulnerability description mentions possible continued video but does not confirm it or explain what users would see or how long transmission might last.
- There are no known reports of exploitation in the wild.
- The developers made shutdown more resilient; users are advised to install available Signal updates.
- The affected and first-fixed Signal app versions had not been publicly confirmed in the sources reviewed.
Article Details
- Vulnerability Types
- Call shutdown flaw involving a call's internal event queue
- Severity
- CVSS 9.3 out of 10
- Affected Versions
- RingRTC versions earlier than 2.72.0
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Install available Signal updates on your devices.
CVE
Vendors
Products
RingRTCThe vulnerability, tracked as CVE-2026-113380 (CVSS score 9.3 out of 10), affects RingRTC versions earlier than 2.72.0. RingRTC is the open-source library behind Signal’s voice and video calling functionality, providingSignalA recently disclosed flaw in Signal’s calling software could allow another participant to keep hearing you after you hang up.