Signal patched a critical bug in its calling engine that could let the other person on a call keep receiving your audio after you press the end-call button. The issue, tracked as CVE-2026-113380, carries a CVSS v4.0 score of 9.3 and affects every RingRTC release before version 2.72.0.
What Is Signal CVE-2026-113380?
CVE-2026-113380 is a call teardown bug, not an encryption flaw.
Signal runs its voice and video calls on RingRTC, an open-source library that powers calling on both the mobile and desktop apps. The bug lives in the code that shuts a call down. A malicious participant could flood the call with events and stop your side from finishing the hangup, so the connection and its media tracks stay alive even though you think the call ended.
Your messages, account, and encryption keys stay safe. The flaw does not leak chat history or passwords, so you do not need to reset anything.
How the Signal RingRTC Hangup Bug Works
The attack targets the queues that Signal uses to process call events.
Each call and each underlying connection runs on a finite-state machine (FSM). These FSMs handle incoming events through fixed-size queues that hold 256 entries each. When a remote peer fills that queue, three problems can stack up:
- Your app cannot submit the termination event because the queue has no room left.
- The old shutdown routine stopped at the first failed step, so later cleanup never ran.
- Other errors, such as a failed notice telling the app the call ended, also cut the teardown short.
The result: you tap end call, the screen likely reflects a finished call, but the media pipeline may keep sending audio to the attacker.
Can Someone Hear You After a Signal Call Ends?
The risk centers on audio you never meant to share.
Once a call fails to close, the other participant could pick up anything your microphone catches next. That includes a side comment after the call, a conversation with someone in the room, or general background noise. The advisory also mentions possible video exposure, but it does not explain how video behaves or what the victim's screen shows. It also leaves out how long the leak could last.
Security researchers have not reported any attacks using this bug outside testing.
How RingRTC 2.72.0 Fixes the Signal Call Flaw
RingRTC 2.72.0 forces a call to close even when individual shutdown steps fail.
Signal developer jim-signal committed the fix on September 4, and the 2.72.0 changelog describes it as ensuring complete call termination in exceptional circumstances. The patch makes three main changes:
- Separate termination flag: The call and connection state machines now check a dedicated flag on their own, so shutdown no longer depends on a queued event getting through.
- Five-second wait limits: Waits for FSM shutdown now time out after five seconds instead of hanging.
- Fail-forward cleanup: Teardown keeps going when a wait or termination step fails, rather than quitting early.
Signal also added regression tests that simulate full call and connection queues plus failed app notifications. These tests confirm that hangup closes the peer connection, mutes outgoing audio, and clears the RTP (Real-time Transport Protocol) packet sink.
Which Signal Versions Are Affected by CVE-2026-113380?
Signal has not named the exact app builds that shipped the vulnerable library.
The fix sits in RingRTC, and Signal has not publicly mapped it to specific Android, iOS, or desktop releases. Some users report Android version 8.32.2 on Google Play and iOS version 8.32 (1910), but Signal has not confirmed whether these builds carry the patched library. Until Signal publishes that list, treat any older install as potentially exposed.
How to Update Signal on Android, iPhone, and Desktop
Updating Signal on every device you own closes the gap.
- On Android, open the Google Play Store, search for Signal, and tap Update if it appears.
- On iPhone or iPad, open the App Store, tap your profile icon, and update Signal from the pending updates list.
- On Windows, macOS, or Linux, open Signal Desktop and install the update when the app prompts you, or download the latest build from the official Signal website.
- Turn on automatic updates so future patches install without delay.
- Before discussing anything sensitive after a call with an unknown or untrusted contact, fully close the Signal app to make sure no session stays open.
Developers who embed RingRTC in their own projects should move to version 2.72.0 or later.
Frequently Asked Questions
Does CVE-2026-113380 break Signal's encryption?
No. The bug affects only how calls shut down. Signal's end-to-end encryption, messages, and account security stay intact.
Can any random person exploit this flaw?
No. The attacker must be a participant in the call with you. A stranger cannot trigger the bug without being on the call.
Do I need to change my Signal PIN or password?
No. The flaw does not expose credentials, recovery keys, or message history, so a reset does nothing to protect you here. Updating the app is the fix.
Is the bug being exploited right now?
No public reports show anyone using it outside testing so far.
Which RingRTC version fixes the issue?
RingRTC 2.72.0 and every later release include the fix.
