When hanging up didn't hang up
A flaw in Signal's calling code let the person on the other end keep a call open after you'd hung up, with your microphone still on. Signal fixed it in September. Check every device is up to date.
When you end a call, you expect it to be over. For anyone on an out-of-date copy of Signal, that wasn't always true. A flaw in the code behind Signal's voice and video calls let the person on the other end stop your hang-up from ending the call. Your screen said the call was over. Your microphone, and possibly your camera, kept sending.
The flaw, CVE-2026-113380, is rated 9.3 out of 10, critical. Signal fixed it on 4 September, and the fix reached its apps over the following weeks. The details were made public on 20 October. Nobody has reported it being used against anyone.
Before the fix
Your hang-up joins the back of the queue, behind everything the other phone has sent. Keep the queue full and it never gets its turn.
With the fix
The hang-up is checked separately, however long the queue is, so it no longer waits its turn.
What went wrong
Signal's calls run on RingRTC, an open-source library Signal writes and maintains. During a call, it works through a queue of events: messages from the other phone, changes in the connection, and your own taps. According to the published CVE record, a peer that saturates that queue could stop a local hang-up from shutting the call down. Your hang-up was just one more event at the back of the line.
Signal's fix, in RingRTC 2.72.0, checks for a hang-up outside the queue. The code comment puts it plainly: terminate "independent of queue depth." It also stops waiting on a call that won't wind down after five seconds, and keeps tearing the call down even if one step fails. Signal's own changelog describes it in one line, as making sure calls "terminate completely in corner cases."
The attacker had to be on a call with you: you rang them, or you answered. A security researcher who publishes as Imahian wrote up the flaw with a simulation of the queue problem, not a working attack. The US cybersecurity agency CISA's assessment, added to the CVE record, lists exploitation as "none".
- Where
- RingRTC 2.72.0, the calling library inside every Signal app.
- Fixed in
- Signal for Android 8.27, iPhone and iPad 8.30, and Desktop 8.30.
- Status
- Rated 9.3, critical. No known attacks. Any copy older than the versions above is still exposed.
The people who use Signal are the ones whose calls matter most.
Why it matters to you
People choose Signal for the calls they don't want overheard: with a lawyer, a doctor, the family office, each other. This flaw didn't break Signal's encryption. It broke something more basic, the assumption that a call you've ended is over. Someone who knew about it could have kept listening after you'd said goodbye, while you picked up the next conversation in the same room.
Most phones update apps on their own, but not all of them, and not always quickly. The device most likely to be behind is the one nobody looks at: an old iPad, a parent's phone with automatic updates switched off, a laptop with Signal Desktop that hasn't been restarted in weeks.
What to do
- Update Signal on every device. In the App Store or Google Play, search for Signal and tap Update if it's offered. You need Android 8.27, iPhone and iPad 8.30, or later. Signal Desktop updates itself; if it's asking to restart, let it. Desktop needs 8.30 or later.
- Do the same for the people you look after. A parent's phone or a child's tablet counts. The call that matters could be with them.
- After a sensitive call, glance at the top of the screen. iPhones show an orange dot while the microphone is in use and a green one for the camera, and recent Android phones show a green indicator. If it's still there after you've hung up, close Signal completely.
Or have someone do it for you. Making sure every device in the family, including the forgotten ones, picks up a fix like this the week it ships is what private cybersecurity is for.
Sources
The public CVE record: affected versions, the 9.3 rating, and CISA's assessment.
cve.orgSignal's fix in RingRTC, with the out-of-band hang-up and the five-second limit.
github.com/signalappEverything that changed in the release that carries the fix.
github.com/signalappThe researcher's write-up, with a simulation of the queue problem.
github.com/ImahianHelp Net Security's report.
helpnetsecurity.comMore from the journal
- The National Public Data breach, explained
A background-check site you never signed up to may have held your Social Security number, and a criminal sold its data. What leaked, what the company said, how the numbers don't agree, and what to do today.
- The 23andMe breach: what happens when your DNA data leaks
Fourteen thousand accounts were opened with reused passwords. Through a sharing feature, millions more were exposed. What happened, what regulators found, and what to do now.
- A hole in the internet's address book
BIND, the software that answers DNS lookups for much of the internet, has a memory flaw that could let an attacker take over the server. There's a fix, and no workaround.