You tap “hang up”, the screen shows the call has ended, but the microphone stays open. That was the risk from a critical flaw in Signal, which the app has already fixed.
The hang-up that did not hang up
The flaw, tracked as CVE-2026-113380 and rated 9.3 out of 10, was in RingRTC, the open source library Signal uses for voice and video calls. SecurityWeek explains the cause: the hang-up request was handled as an ordinary event in an internal call queue, with no priority and no limit on events coming from the other side.
So the attack was to flood that queue with junk. The hang-up request waited behind the noise, as a researcher describes in a GitHub write-up the report does not name. The result: an attacker could keep the microphone and possibly the camera of the device active while the victim believed the call had ended.
Already fixed
The fix is in RingRTC 2.72.0, released September 4. The termination request no longer gets stuck in the queue and is detected independently. Details and a proof of concept were published on a Tuesday, and the US government logged the flaw in its vulnerability database the same day. The report does not say the flaw was exploited in real attacks.
How to protect yourself
- Update Signal on your phone and your computer. It is the only measure that solves this.
- Check your phone’s microphone indicator on Android or iPhone after a call. If it stays on, close the app.
- Be wary of calls from unknown numbers on Signal and any other app. The flaw required someone to call you.
- Turn on automatic app updates in your phone’s store.
