Critical Bug in Signal Left Microphone Active After Calls

A critical vulnerability has been discovered in RingRTC, the library powering voice and video calls in the Signal messenger. Researchers identified a bug that could leave the device's microphone and camera active after a call ends.

The vulnerability received a CVSS score of 9.3, indicating a high level of danger. The issue lies in how call events are handled: the hang-up command is queued at the end without priority.

An attacker can flood the queue with extra events, causing the connection termination command to be delayed. As a result, audio and video continue to stream to the attacker even after the user sees the call-ending screen.

Direct access to the victim's phone is not required for the attack—initiating a call is sufficient. The vulnerability author published a working Proof of Concept (PoC) in Python demonstrating the exploit mechanism.

Devices running Android, iOS, and desktop versions with RingRTC builds older than 2.72.0 are at risk. A fix for the desktop version was released back in September, while the release date for the mobile patch remains unknown.

Developers resolved the issue by isolating the hang-up command processing into a separate thread. A timeout was also added to prevent event queue deadlocks, ensuring the microphone and camera turn off correctly.

Details about CVE-2026-113380 are available in the researcher's repository. The patch for the desktop version can be found in the RingRTC project changelog.