NewsCompaniesFlawsGuides
Get the app

Signal calls could stay open after you hung up, fixed in Android 8.27, iOS 8.30 and Desktop 8.30

From the HARD Situation Room · First reported
For everything else happening in security now, see the Situation Room.

CVE-2026-113380, rated 9.3: someone on a Signal call with you could stop your hang-up from ending it, leaving your microphone (and possibly camera) on. Signal fixed it in September. No known attacks.

A flaw in Signal's calling code let the person on the other end keep a call open after you'd hung up, with your microphone still on. Signal fixed it in September. Check every device is up to date.

What happened

When you end a call, you expect it to be over. For anyone on an out-of-date copy of Signal, that wasn't always true. A flaw in the code behind Signal's voice and video calls let the person on the other end stop your hang-up from ending the call. Your screen said the call was over. Your microphone, and possibly your camera, kept sending.

The flaw, CVE-2026-113380, is rated 9.3 out of 10, critical. Signal fixed it on 4 September, and the fix reached its apps over the following weeks. The details were made public on 20 October. Nobody has reported it being used against anyone.[1]

Before the fix

Your hang-up joins the back of the queue, behind everything the other phone has sent. Keep the queue full and it never gets its turn.

With the fix

The hang-up is checked separately, however long the queue is, so it no longer waits its turn.

Why the call didn't end.Simplified from Signal's fix to RingRTC, its calling library.

Timeline

  1. Signal fixes it. In RingRTC 2.72.0, the calling library inside every Signal app.[2]

  2. The apps catch up. Fixed in Signal for Android 8.27, iPhone and iPad 8.30, and Desktop 8.30.

  3. Made public. Rated 9.3, critical. No known attacks. Any copy older than the versions above is still exposed.[1]

  4. HARD publishes its article, at High.

What went wrong

Signal's calls run on RingRTC, an open-source library Signal writes and maintains. During a call, it works through a queue of events: messages from the other phone, changes in the connection, and your own taps. According to the published CVE record, a peer that saturates that queue could stop a local hang-up from shutting the call down. Your hang-up was just one more event at the back of the line.

Signal's fix, in RingRTC 2.72.0, checks for a hang-up outside the queue. The code comment puts it plainly: terminate "independent of queue depth." It also stops waiting on a call that won't wind down after five seconds, and keeps tearing the call down even if one step fails. Signal's own changelog describes it in one line, as making sure calls "terminate completely in corner cases."

The attacker had to be on a call with you: you rang them, or you answered. A security researcher who publishes as Imahian wrote up the flaw with a simulation of the queue problem, not a working attack.[3] The US cybersecurity agency CISA's assessment, added to the CVE record, lists exploitation as "none".

The people who use Signal are the ones whose calls matter most.

Who is affected

People choose Signal for the calls they don't want overheard: with a lawyer, a doctor, the family office, each other. This flaw didn't break Signal's encryption. It broke something more basic, the assumption that a call you've ended is over. Someone who knew about it could have kept listening after you'd said goodbye, while you picked up the next conversation in the same room.

Most phones update apps on their own, but not all of them, and not always quickly. The device most likely to be behind is the one nobody looks at: an old iPad, a parent's phone with automatic updates switched off, a laptop with Signal Desktop that hasn't been restarted in weeks.

How this reaches a family

  1. The device nobody updatesAn old iPad, a parent’s phone with automatic updates off, a laptop that never restarts.
  2. HARDUpdates ranked, for the whole familyHARD ranks missing updates by what attackers are using, on every device it watches. If you look after a parent’s phone or Mac, you see their missing updates too, and your engineer can walk them through it.See how it works
  3. A call with someone who knows the flawThe conversation ends, and you hang up.
  4. The microphone stays onThe screen says the call is over. The other end is still listening.
Where HARD comes in.With HARD, the greyed-out steps don’t happen.

What to do

  1. Update Signal on every device. In the App Store or Google Play, search for Signal and tap Update if it's offered. You need Android 8.27, iPhone and iPad 8.30, or later. Signal Desktop updates itself; if it's asking to restart, let it. Desktop needs 8.30 or later.
  2. Do the same for the people you look after. A parent's phone or a child's tablet counts. The call that matters could be with them.
  3. After a sensitive call, glance at the top of the screen. iPhones show an orange dot while the microphone is in use and a green one for the camera, and recent Android phones show a green indicator. If it's still there after you've hung up, close Signal completely.

Or have someone do it for you. Making sure every device in the family, including the forgotten ones, picks up a fix like this the week it ships is what private cybersecurity is for.

  • CVE-2026-113380 Not on CISA’s list of flaws being used in attacks. Look it up in Search.
  • Android every Android flaw being used in attacks

References

Checked against the sources. App versions are the first releases in Signal's own repositories that include the fixed library.

  1. ^ CVE Program. “CVE-2026-113380”. The public CVE record: affected versions, the 9.3 rating, and CISA's assessment.
  2. ^ Signal. “Ensure calls terminate completely in corner cases”. Signal's fix in RingRTC, with the out-of-band hang-up and the five-second limit.
  3. ^ Imahian. “CVE-2026-113380 notes”. The researcher's write-up, with a simulation of the queue problem.
  4. Signal. “RingRTC 2.71.0 to 2.72.0”. Everything that changed in the release that carries the fix.
  5. Help Net Security (). “Signal flaw could expose audio and video even after users hang up”. Help Net Security's report.

Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.