Signal bug could let someone keep listening after you hang up

A recently disclosed flaw in Signal’s calling software could allow another participant to keep hearing you after you hang up. The vulnerability, tracked as CVE-2026-113380 ( CVSS score 9.3 out of 10), affects RingRTC versions earlier than 2.72.0. RingRTC is the open-source library behind Signal’s voice and video calling functionality, providing calling components for its mobile and desktop applications. The flaw concerns how Signal’s calling library shuts down a call. It does not affect how it encrypts conversations. According to the published vulnerability description , another participant could overwhelm a call’s internal event queue and interfere with the steps that should disconnect it when you end the call. The main concern is unwanted listening after someone believes a conversation has ended. If a malicious call participant successfully triggered the flaw, they could potentially continue hearing audio that the other person no longer intended to share. That might include an offhand remark, a conversation with someone nearby, or other private background sound. The vulnerability description also mentions that video might remain active, but does not confirm that behavior or explain what affected users would see on screen. It also doesn’t specify how long any continued transmission might last. There are no known reports of exploitation in the wild. The vulnerability concerns only how a call is shut down. It does not involve stolen passwords, compromised accounts, or exposed message histories that would call for a password reset. What to do The developers updated the code to make shutdown more resilient when a call’s internal queue is full or another termination step fails. Install any available Signal updates on your devices. The fix is available in the underlying RingRTC library, but the affected and first-fixed Signal app versions have not yet been confirmed publicly in the sources reviewed. Personally, I found an update in the Google Play Store which brought my Android app to version 8.32.2. I did not find one in the Apple App Store, although this might be because I have automatic updates enabled . The current version on my iPad is listed as 8.32 (1910). While I think that means it’s all patched, this is hard to confirm from Signal’s website. I’ve emailed Signal for clarification and will update this article when I hear back. Scammers know more about you than you think. Malwarebytes Mobile Security protects you from phishing , scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. About the author Was a Microsoft MVP in consumer security for 12 years running. Can speak four languages. Smells of rich mahogany and leather-bound books.