A Critical Signal Bug Could Let the Other Person Keep Listening to Your Mic After You Hang Up

People choose Signal because nobody is supposed to be able to listen in. A newly disclosed critical bug undercut that in a very human way: the person on the other end of a call could make your hangup fail, so your microphone kept streaming to them after you thought you had said goodbye.

The flaw, tracked as CVE-2026-113380 and published by MITRE on Tuesday, carries a severity score of 9.3 out of 10. It sits in RingRTC, the open source library that powers Signal's voice and video calls on mobile and desktop, and it affects every version before 2.72.0.

How the hangup gets lost

RingRTC is Signal's own calling layer, built on WebRTC, the real-time communication technology introduced in 2011. It manages each call with a finite state machine fed by an event queue. According to The Register, the attack is essentially a denial of service on that queue. A participant floods it with events until it can no longer process your hangup, and the call simply does not end.

From your side, the call looks finished. Underneath, the audio channel, and possibly video, can stay open. The bug is classified as CWE-754, an improper check for unusual or exceptional conditions, and the attack complexity is rated low. The GitHub advisory includes a conceptual proof of concept: a Python script that simulates the queue flood.

There is an important limit. The attacker has to be a participant on the call. A stranger cannot use this to tap into conversations they were never part of.

What was at risk, and what was not

Signal's encryption was never broken. As Malwarebytes points out, the bug does not touch how Signal encrypts conversations. No passwords were stolen, no accounts compromised, no message history exposed, and nobody needs to reset anything.

The danger is the moment after goodbye. An open line could pick up an offhand remark, a conversation with someone nearby, or private background sound you would never share on purpose. How long the transmission could continue is unknown.

It is the same category of harm as the Meta Muse zero day that hijacked dictation: the mic stays live when the person holding the phone believes it is off.

There is no sign anyone used it. CISA's Known Exploited Vulnerabilities catalog does not list the flaw.

The fix, and the fuzzy rollout

RingRTC 2.72.0 shipped in September, and the bug only became public this week. The fix changes the call state machine so it detects termination requests independently of the event queue, and adds a timeout so stalled processing can no longer block a hangup indefinitely.

What is less clear is when each Signal app picked it up. Signal Desktop's release history shows RingRTC 2.72.0 was incorporated in September, but rollout dates across platforms are murky. Signal did not respond to The Register, and Malwarebytes said it had emailed the company for clarification. The Malwarebytes author noted that his own Android app reached version 8.32.2 after updating, though that is his observation rather than an official fixed version.

That leaves users with one practical step, and both write-ups point to it: update Signal on every device, phone and desktop alike. The encryption held the whole time. What failed was the one thing people assume without thinking, that a call is over when they hang up.

Some offers on this page may be paid placements or contain affiliate links.