Critical Signal flaw could leave calls recording after hang-up

A bug in Signal’s calling library could stop a call from ending properly, leaving audio or video active after someone believes they have hung up. The flaw was rated critical, with a CVSS score of 9.3, and could expose users to unintended recording or viewing if exploited.

The vulnerability, CVE-2026-113380, affects RingRTC versions before 2.72.0. A caller could overwhelm the library’s event queue so it fails to process a hang-up request; the fix makes termination requests independent of that queue and adds a timeout. The article says there is no indication the flaw has been exploited in the wild, and advises updating Signal on mobile and desktop.