Signal Fixes Critical Vulnerability That Kept Microphones and Cameras Active After Hangers-Up

Encrypted messaging giant Signal has successfully resolved a critical-severity security vulnerability that could have allowed a malicious caller to secretly keep a victim’s audio and video recording tracks enabled even after the user had explicitly hung up the phone. The alarming flaw exposes a previously hidden architectural risk within real-time communication software design, demonstrating how seemingly routine queue management oversights can lead to severe privacy violations.

The security defect has been officially tracked and cataloged under the identifier CVE-2026-113380. Security assessment authorities have assigned it a critical CVSS score of 9.3, underlining the severe risk it posed to end-user privacy and device integrity. The vulnerability specifically impacts RingRTC, the specialized open-source library that Signal utilizes to power its secure voice and video call infrastructure. RingRTC itself is built upon WebRTC, the widely adopted real-world standard for enabling peer-to-peer real-time communications across browsers and mobile applications.

According to technical analysis of the vulnerability, the core issue stemmed from how incoming network events were processed during an active conversation. Specifically, a remote peer actor could actively flood the call’s Finite State Machine, commonly referred to as the FSM, event queue with a barrage of junk data packets. Because of this artificial congestion, the ongoing call would persistently fail to terminate when the local user attempted to end it.

The underlying mechanics of the flaw reveal a fundamental oversight in event prioritization and queue design. The routine user action of hanging up a call was not treated as an immediate, overriding kill switch that could instantly sever all data streams. Instead, the termination request was simply processed as just another standard event and placed directly into the FSM event queue. Compounding this vulnerability was the complete lack of a rate-limiting mechanism for peer-originated events, combined with the fact that the crucial hangup event carried no special priority or fast-track status.

Security researchers who analyzed the behavior broke down the failure in a public GitHub write-up documenting CVE-2026-113380. They explained that if an attacker chose to flood the queue with junk data, the legitimate hang-up command would be forced to wait behind the attacker’s generated noise indefinitely. As a direct consequence of this queue starvation, the underlying call infrastructure—including the microphone and potentially the camera—was never properly torn down by the software.

By successfully exploiting this vulnerability, a malicious caller could effectively keep audio and video data tracks flowing seamlessly from a target device while the unsuspecting victim was left under the firm belief that they had successfully terminated the call. This created a profound privacy loophole, as users routinely rely on visual indicators and standard hang-up buttons to secure their physical environments after a conversation concludes.

Signal’s engineering and security teams moved to address the threat by releasing RingRTC version 2.72.0 on September 4, containing the necessary patches to neutralize the flaw. However, comprehensive technical details regarding the exact nature of the security defect were only made public on Tuesday, coinciding with the release of a conceptual proof-of-concept demonstration. Concurrently, the National Institute of Standards and Technology officially added the CVE entry to the National Vulnerability Database on the same day.

To remediate the vulnerability permanently, Signal modified its codebase to ensure that call termination requests are no longer blocked inside the FSM’s congested event queue. Under the updated architecture, hang-up requests are detected and prioritized independently, ensuring that an attacker cannot block a user from cutting off data transmission streams.

In light of the discovery, cybersecurity experts and platform administrators strongly advise all users to update their Signal applications to the latest available versions as soon as possible. For individuals who may not have immediate access to application updates, security professionals recommend maintaining heightened vigilance by actively checking visual call status indicators to verify that a conversation has indeed ended and that all peripheral hardware lights or software indicators have turned off.