Vulnerabilities · 3h ago

Signal call bug can leave microphone and camera active

The Register reported Oct. 21 that Signal’s RingRTC calling library has a critical flaw, CVE-2026-113380, that could leave a user’s microphone or camera active after hangup.

In ordinary use, ending the call may fail to stop its audio or video capture, so the expected privacy boundary at goodbye may not hold. The report gives no evidence that an attacker can access the still-active media or that the flaw has been exploited.

For Signal users, this is a call-state privacy risk, not evidence of eavesdropping. The available reporting does not establish which releases remain exposed or whether a specific update closes the flaw, leaving the scope of exposure unresolved.

CVE-2026-113380

NVD KEV

EPSS 0.3% (24th percentile).

Timeline

Oct 22 Reported by Help Net Security
Oct 21 Reported by The Register Security

Sources

2 sources covering this story

Help Net Security Oct 22
Signal flaw could expose audio and video even after users hang up - Help Net Security
A RingRTC vulnerability (CVE-2026-113380) could let the other person on a Signal call keep receiving audio after hang-up.
The Register Security Oct 21
Signal bug could keep your mic - and camera
Careful what you say after goodbye, or better yet, update your messaging app

Entities

CVE-2026-113380

Part of the PlainSec briefing for 2026-10-22

Editions

Briefing for 2026-10-22

Vulnerabilities · 3h agoSignal call bug can leave microphone and camera activeThe Register reported Oct. 21 that Signal’s RingRTC calling library has a critical flaw, CVE-2026-113380, that could leave a user’s microphone or camera active after hangup.In ordinary use, ending the call may fail to stop its audio or video capture, so the expected privacy boundary at goodbye may not hold. The report gives no evidence that an attacker can access the still-active media or that the flaw has been exploited.For Signal users, this is a call-state privacy risk, not evidence of eavesdropping. The available reporting does not establish which releases remain exposed or whether a specific update closes the flaw, leaving the scope of exposure unresolved.