Signal Call Flaw Lets Participants Listen After Hangup

Malwarebytes Labs identified a vulnerability in Signal’s calling software that permits another participant to continue hearing audio after a user ends a call. The flaw, tracked as CVE-2026-113380, carries a CVSS score of 9.3 and affects RingRTC versions earlier than 2.72.0, the open-source library powering Signal’s voice and video features.

The vulnerability stems from how the calling library handles call shutdown procedures. According to the published description, a malicious participant can overwhelm the call’s internal event queue. This interference disrupts the steps required to disconnect the session properly when one side terminates the call, leaving the audio channel open.

How the Flaw Operates

The primary risk involves unwanted listening after a user believes the conversation has concluded. If an attacker successfully triggers the flaw, they may continue to receive audio streams from the other participant. This could expose offhand remarks, nearby conversations, or other private background sounds that the user no longer intended to share.

The technical report notes that video transmission might also remain active, though it does not confirm this behavior or describe what affected users would see on their screens. The description also fails to specify the duration of any continued transmission, leaving the exact scope of exposure unclear.

Scope and Impact

There are no known reports of this vulnerability being exploited in the wild. The issue is isolated to the call shutdown mechanism and does not involve encryption failures, stolen passwords, or compromised accounts. Consequently, users do not need to reset passwords or worry about exposed message histories based on this specific flaw.

That suggests the threat is limited to real-time call scenarios rather than stored data or account integrity. The developers have updated the underlying code to make the shutdown process more resilient when the internal queue is full or when termination steps fail, addressing the root cause of the persistence issue.

What should you do?

Users should install available Signal updates on their devices to mitigate the risk. The fix exists in the underlying RingRTC library, but public sources have not yet confirmed which specific Signal app versions include the patch. A researcher noted finding version 8.32.2 on Android and 8.32 on iPad, but could not definitively confirm these versions contain the fix.

What to do and how to stay safe: Signal

• Check your app store for Signal updates and install them immediately to ensure you have the latest security patches.
• Verify your current Signal app version against any official advisories released by the Signal Foundation or trusted security researchers.
• Be cautious during calls with unknown participants, as the flaw requires a malicious actor to be present in the active call session.
• Monitor official Signal channels for confirmation of which specific app versions include the fix for CVE-2026-113380.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this bug allow hackers to read my old messages?

No, the vulnerability only affects how calls are shut down and does not involve exposed message histories or compromised accounts.

Is this vulnerability being used in real attacks?

There are no known reports of exploitation in the wild according to the research published by Malwarebytes Labs.

What version of Signal fixes this issue?

The fix is in RingRTC 2.72.0, but the specific Signal app versions containing the update have not been publicly confirmed.