A flaw in Signal’s calling software could allow a participant in a call to keep hearing audio after the other person hangs up. Tracked as CVE-2026-113380, with a CVSS score of 9.3 out of 10, the vulnerability affects RingRTC versions earlier than 2.72.0. RingRTC is the open-source library used for voice and video calling in Signal’s mobile and desktop apps.
The issue lies in how the software ends a call, not in Signal’s encryption. According to the published vulnerability description, a participant could overwhelm the call’s internal event queue and disrupt the steps that should disconnect it. If successful, this could leave audio transmitting, potentially exposing private remarks or background conversations. The description also mentions that video might remain active, but this behaviour is unconfirmed; it does not say how long any transmission could continue. There are no known reports of exploitation in the wild.
The developers have changed the code to make call shutdown more resilient if the queue is full or another termination step fails. Signal users should install available app updates. The article says the fix is in RingRTC, but the affected and first-fixed Signal app versions had not been publicly confirmed at the time of writing. The flaw does not involve stolen passwords, compromised accounts or exposed message histories, so the article says a password reset is not needed.