All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
You hang up a Signal call, believing it's over. But a critical flaw in the messaging app's calling software could allow the person on the other end to keep listening after you've ended the conversation.
The vulnerability, tracked as CVE-2026-113380, affects RingRTC, the software Signal uses to handle voice and video calls. It has a severity rating of 9.3 out of 10 and could prevent a call from shutting down properly if another participant deliberately overwhelms part of the calling system.[1]
That means a private conversation, background noise, or something you say after hanging up could potentially reach someone you thought was no longer listening. There's no public evidence that attackers have exploited the flaw in real-world calls.
Here's how the vulnerability works, which Signal versions are affected, and what you can do to protect your conversations. You can also read our broader guide to whether Signal is safe.
Signal uses a calling library called RingRTC to manage voice and video calls. When you hang up, the software must stop sending audio and video, close the connection, and notify the other participant that the call has ended.
To handle these actions, RingRTC uses an internal queue that processes events one at a time. According to the official vulnerability record, a malicious participant could overwhelm that queue with activity during a call. If the queue becomes full, it can interfere with the software's ability to process a hang-up request.
As a result, someone could believe they've ended a call while the underlying connection hasn't shut down properly. The other participant might still receive microphone audio, potentially exposing conversations or sounds that were never meant to be shared.
The vulnerability description also suggests that video could remain active, although that possibility hasn't been confirmed. Researchers haven't established how long an affected connection might continue transmitting audio or what warning signs, if any, users would see.
Signal's developers addressed the issue in an update to RingRTC. The changes help the software recognize termination requests even when its event queue is overloaded and prevent a stalled shutdown process from blocking the call indefinitely.
The most important step is to update Signal on every device where you use it. The vulnerability affects RingRTC versions before 2.72.0, and an October 20 advisory reproducing guidance from Italy's national cybersecurity incident response team identifies the following affected Signal versions:
| Software | Affected versions | Version to update to |
| Signal for Android | Before 8.27.0 | 8.27.0 or later |
| Signal for iOS | Before 8.30.0 | 8.30.0 or later |
| Signal Desktop | Before 8.29.0 | 8.29.0 or later |
| RingRTC library | Before 2.72.0 | 2.72.0 or later |
If you're using an older version, install the latest available update through the Google Play Store, Apple App Store, or Signal's official desktop app. You can also enable automatic updates so future security fixes reach your devices sooner.
Although the affected version ranges have been identified, the precise dates when the fixed RingRTC code reached every Signal platform aren't fully documented in public release notes. Updating to the latest available version remains the safest approach.
Keep in mind that this vulnerability isn't a way for a stranger to secretly activate your microphone at any time. An attacker would need to be participating in an affected call and deliberately interfere with the shutdown process.
The flaw also doesn't describe a method for stealing passwords, accessing message history, or taking over Signal accounts. You don't need to reset your passwords solely because of this vulnerability.
As of October 22, 2026, there are no known public reports of attackers exploiting the bug in the wild. That doesn't mean exploitation is impossible, but it does mean the published findings describe a potential attack rather than a confirmed widespread compromise.
A Signal call should end when you hang up, but this vulnerability shows how a failure in the shutdown process could leave microphone audio exposed to someone on the other end. The risk comes from a malicious call participant, not someone remotely accessing your phone without joining a call.
The underlying flaw has been fixed, and affected Signal app versions have been identified. Check that you're running the latest Signal release on your phone and computer, and keep automatic updates enabled to receive future security fixes.
Top-rated data removal service that scrubs your info from 420+ data broker sites automatically
Independently verified by Deloitte, meaning removals are actually sent, confirmed, and not just claimed
The Unlimited plan extends coverage to 2,000+ additional sites with human-assisted custom removals
/images/2023/10/12/best_identity_theft_protection_with_dark_web_monitoring.jpg)
/images/2023/07/07/best-identity-theft-protection-service.png)
/images/2026/10/22/closeup_of_the_signal_messaging_app_icon_on_a_smartphone_screen_displa_ESczEq4.jpg){kind=icon}
/images/2026/10/22/beware_these_phishing_tricks_after_historic_internet_meltdown.png)
/images/2026/10/20/google-search-redirects-privacy-security.jpeg)
/images/2026/10/20/trump-administration-voter-data-lawsuit.jpeg)
/images/2026/10/19/stop-shop-food-lion-app-outage.jpeg)
/images/2026/10/19/apple-photos-app-facial-recognition-privacy-lawsuit.jpeg)
/authors/krishi_chowdhary_headshot.jpg){kind=small}
/authors/kate-quinlan-new.jpg){kind=small}
/images/2025/09/11/incogni-logo.png){kind=logo}
/authors/krishi_chowdhary_headshot.jpg)