Signal Call Flaw Leaves Audio Active After Hangup

A vulnerability in Signal’s calling infrastructure can cause calls to remain active after a participant believes they have ended the conversation. According to Malwarebytes Labs, this flaw allows another party to continue hearing audio, and possibly seeing video, after the user hangs up. The issue stems from how the application handles call termination rather than encryption failures.

How does the flaw work technically?

The vulnerability, tracked as CVE-2026-113380, resides in RingRTC, the open-source library powering Signal’s voice and video features. According to The Register, the bug affects versions earlier than 2.72.0. It operates by overwhelming the library’s internal event queue, which manages call state changes. When saturated, the queue fails to process the hangup request properly.

This behavior is classified as CWE-754, or improper checking for unusual conditions. The Register notes that a malicious participant could flood the finite state machine queue with requests. This denial-of-service style attack prevents the system from executing the termination steps, leaving the media channels open even though the user interface indicates the call has ended.

What is the potential impact on users?

The primary risk is unauthorized surveillance of private moments after a call concludes. Malwarebytes Labs states that a successful exploit could allow a listener to hear offhand remarks or background conversations. The vulnerability description mentions that video might also remain active, though it does not confirm what the affected user would see on their screen. The duration of this continued transmission is unspecified.

Crucially, the flaw does not compromise message history, passwords, or account credentials. According to Malwarebytes, there are no known reports of exploitation in the wild. The issue is strictly limited to the call shutdown process and does not involve stolen data or exposed chats that would require a password reset.

Is a fix available for affected devices?

Developers have updated the code to make the shutdown process more resilient against queue saturation. The fix is available in RingRTC version 2.72.0 and later. However, according to Malwarebytes Labs, the specific Signal app versions that contain this patched library have not been publicly confirmed. Users should install any available updates for their operating systems.

The author of the Malwarebytes report found an update in the Google Play Store bringing the Android app to version 8.32.2. An update was not immediately visible in the Apple App Store for their iPad, which listed version 8.32 (1910). Signal has not provided clarification on which app versions are definitively patched.

What analysts watch for

Teams usually monitor for anomalous call termination events where media streams persist beyond the expected end time. Analysts should examine logs for event queue saturation or unusual spikes in signaling traffic during hangup sequences. Check whether the application state correctly reflects the connection status versus the actual media flow. Look for discrepancies between the UI indication of a closed call and the backend status of audio or video channels.

What to do and how to stay safe: Signal

• Update your Signal application to the latest version available in your device’s app store.
• Verify that your app version is 8.32.2 or higher on Android, or check for recent updates on iOS.
• Avoid sharing sensitive information immediately after hanging up a call until you confirm your app is patched.
• Monitor for any unexpected behavior, such as the camera or microphone remaining active after ending a call.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this bug expose my past messages or passwords?

No, the vulnerability only affects how calls are shut down and does not involve stolen passwords or exposed message histories.

Is this flaw currently being exploited by attackers?

There are no known reports of exploitation in the wild according to Malwarebytes Labs.

Which versions of RingRTC are affected by CVE-2026-113380?

The flaw affects RingRTC versions earlier than 2.72.0, which are used in older versions of the Signal app.