Signal call bug can leave microphone and camera active
The Register reported Oct. 21 that Signal’s RingRTC calling library has a critical flaw, CVE-2026-113380, that could leave a user’s microphone or camera active after hangup.
In ordinary use, ending the call may fail to stop its audio or video capture, so the expected privacy boundary at goodbye may not hold. The report gives no evidence that an attacker can access the still-active media or that the flaw has been exploited.
For Signal users, this is a call-state privacy risk, not evidence of eavesdropping. The available reporting does not establish which releases remain exposed or whether a specific update closes the flaw, leaving the scope of exposure unresolved.