Signal’s Hang-Up Button Had a Critical Blind Spot

A critical flaw in Signal’s calling infrastructure, specifically within its RingRTC library, could prevent calls from fully shutting down, leaving audio—and potentially video—streaming to the other participant. Users tapping the hang-up button might have believed the call had ended, only for their microphone and camera to remain active. This vulnerability, tracked as CVE-2026-113380 with a CVSS 4.0 score of 9.3 (Critical), exposed a silent surveillance risk.

Exploitation required an attacker to already be on the call; this was not a mechanism for strangers to initiate silent eavesdropping or broadly compromise Signal accounts. The bug’s scope was strictly limited to call teardown, meaning Signal messages, account infrastructure, and its robust end-to-end encryption remained unaffected. There is no evidence suggesting this flaw was exploited in the wild.

The underlying issue stemmed from RingRTC’s Finite State Machine (FSM) queue, which lacked rate-limiting for incoming peer events and a priority lane for termination signals. An attacker could flood this queue, blocking the local hang-up event and keeping the media streams alive. Signal addressed the issue on September 4, committing a fix to ensure calls terminate completely, followed by silent rollouts across Android, iOS, and Desktop clients before the CVE was publicly assigned on October 20.

Signal’s open-source calling library, RingRTC, powered its voice and video calls across Android, iOS, and desktop. The reported cause of this critical flaw, tracked as CVE-2026-113380, centered on RingRTC’s bounded finite-state-machine event queue, which held a capacity of 256 entries.

This design created a critical blind spot. Peer-generated events could easily flood the queue, while a local hang-up — the user pressing the red button — had no priority. Instead, the termination event waited in line behind ordinary call events, unable to force immediate teardown.

If the shutdown process stalled, the microphone stream, and potentially the camera stream, remained live to the other participant. A remote peer could effectively prevent a call from fully terminating, leaving audio and video flowing. This vulnerability earned a CVSS 4.0 score of 9.3, signaling its critical severity. While alarming, there’s no evidence of in-the-wild exploitation, and the flaw required an active participant to trigger.

Signal committed a fix to RingRTC on September 4, with a remarkably understated changelog entry: “ensure calls terminate completely in corner cases.” This patch, which added independent shutdown handling and a hard timeout, rolled out across Android, iOS, and desktop builds over the subsequent weeks. While this quiet update might raise questions about transparency, it’s not proof of bad faith; rapid, unannounced patching of critical vulnerabilities is standard practice before public disclosure.

The full picture emerged on October 20, when CVE-2026-113380 became public. This critical (CVSS 9.3) vulnerability confirmed the severity of the hang-up flaw, validating the silent rollout. RingRTC 2.72.0 and later Signal builds contain the remediation, preventing a flooded queue from blocking termination events. For more technical details on the library, consult the signalapp/ringrtc Repository on GitHub.

Users should update Signal immediately on all platforms—Android, iPhone, and desktop—to ensure their calls truly end when they tap that red button. While there’s no evidence of in-the-wild exploitation, and the issue only affected active call participants, this incident underscores a recurring challenge in real-time communication: building a reliable hang-up function is harder than it looks. FaceTime and Google Duo have faced similar issues.

This RingRTC episode offers a stark reminder: call termination is a surprisingly complex and security-critical state transition. It echoes past incidents where communication apps stumbled at the finish line, or even before the race began. In 2019, Apple’s FaceTime suffered a critical flaw that exposed audio from a recipient’s device before they answered, forcing Apple to disable Group FaceTime until it was resolved.

That same year, Google’s Project Zero identified call-connection vulnerabilities in Signal for Android, Google Duo, and Facebook Messenger. Those earlier bugs allowed callers to force connections. This RingRTC flaw, however, represents a distinct issue: a teardown failure where the hang-up button, intended as a definitive kill switch, was defeated by a crowded event queue.

The engineering lesson is clear: setup and shutdown are highly vulnerable phases in real-time communication protocols. Remote peers can generate events, often unpredictably, and these events must not be allowed to impede critical security functions. Developers must treat the hang-up function as a protected, high-priority kill switch. Users, in turn, should cultivate the habit of checking their mobile device’s microphone and camera indicators after every call, ensuring the conversation has truly ended.

What was the Signal call vulnerability?

A flaw in RingRTC could let someone already on a call flood its event queue and prevent a user’s hang-up from fully terminating the call.

Could a stranger use the Signal call bug to listen in?

No. The flaw required an attacker to already be a participant in an active call; it did not enable random outsiders to eavesdrop.

Were Signal messages or encryption affected?

No. The reported issue concerned call teardown and media streams, not Signal’s messaging encryption, accounts, or databases.

How can Signal users protect themselves?

Update Signal on every device to the latest available version. On mobile, check the microphone and camera privacy indicators after ending a call.