Signal vulnerability: the call you hang up can keep listening
You hang up. The screen says “Call ended”. Yet your phone’s microphone keeps sending what is said in your office to the person who called you. That’s what a Signal vulnerability made public on Tuesday, October 20 allowed: CVE-2026-113380, rated 9.3 out of 10.
Many business owners and teams use Signal for conversations they want to keep private. The good news: the fix has existed since September 4, and an up-to-date device is protected. The less good news: in a small business, there is often an old phone, tablet or computer where Signal hasn’t been updated in months.
Signal vulnerability: the ended call that keeps listening
Unknown number
2Call ended
What the screen doesn’t tell you
- 1The phone’s microphone indicator (orange dot on iPhone, green icon on Android) stays on after the call ends. It’s the only visible sign.
- 2The screen says “Call ended”, but on a vulnerable version the audio connection, and possibly video, can keep running in the background.
- NoneThe cause: the malicious caller floods the call’s internal queue (256 slots). Your hang-up order gets stuck behind their “noise”, and the call clean-up never happens.
The flaw is in RingRTC, the library that handles audio and video calls in every Signal app: Android, iPhone and desktop. According to the CVE record, a caller who saturates the call’s queue can stop your hang-up from fully closing the connection. Signal’s fix adds a stop signal that doesn’t depend on that queue, caps the wait at five seconds and finishes the clean-up even if a step fails.
Should you worry? Severity versus urgency
Severity and urgency: two different things
Technical severity (CVSS 4.0) 9.3 / 10
A “critical” rating: a caller can listen to what is said after you hang up, without any other access to your phone.
Known exploitation none
No real attack reported, and the flaw is not in CISA’s catalogue of exploited vulnerabilities. But a proof-of-concept write-up has been public since October 20.
Fix available for 7 weeks
Signal fixed the library on September 4. A phone that installs its updates is already protected.
In other words: no need to panic, but no reason to leave an old Signal on a company phone.
The versions that fix the Signal vulnerability
Signal hasn’t published an official list of affected versions. ThreatWire checked Signal’s public source code for the first release of each app that includes the fix:
| Device | Minimum safe version | Where to see the version |
|---|---|---|
| Android | 8.27.0 or later | Signal › profile picture › Help: the number is shown |
| iPhone and iPad | 8.30 or later | Signal › Settings › Help |
| Computer (Signal Desktop) | 8.29.0 or later | Windows and Linux: Help › About; Mac: Signal menu › About |
| App that embeds RingRTC (developers) | RingRTC 2.72.0 or later | The project’s dependency file |
Three misconceptions to correct
❌ Myth 1
“Signal is encrypted, so this flaw doesn’t concern me.”
✅ Fact 1
Encryption isn’t the issue. The flaw affects how a call ends: the conversation stays encrypted, but it keeps flowing to the person who called you while you think you’ve hung up.
❌ Myth 2
“The attacker would need access to my phone.”
✅ Fact 2
No. Being on a call with them is enough. That’s why calls from unknown numbers deserve a bit more caution until your devices are up to date.
❌ Myth 3
“I updated my phone, so my computer is updated too.”
✅ Fact 3
Signal Desktop and the iPad update separately. A desktop app left open for weeks may only need a restart to install the update.
Your plan for today
The 20-minute mobile fleet round
- ☐ List the company phones, tablets and computers where Signal is installed, including personal phones used for work.
- ☐ Check the version on each one with the table above. Anything older: update today.
- ☐ Turn on automatic app updates (Google Play and App Store), then restart Signal Desktop.
- ☐ If you manage devices with Microsoft Intune, use its app inventory to spot outdated versions on company devices.
- ☐ Remind the team of a simple habit: after a sensitive call, check that the microphone indicator is off before discussing anything confidential.
📞 What about WhatsApp, Teams or Zoom?
Nothing suggests they are affected: this flaw is specific to Signal’s calling library. But the lesson applies to all your calling apps. A published fix only protects the devices that installed it, and the details of a flaw always end up public, here seven weeks after the fix.
Calls and messages remain a favourite way in: read our article on device code phishing, which often starts with a harmless-looking message. And if your team uses Microsoft 365, our Microsoft 365 services include device management with Intune to keep apps up to date.
At NeoTech, our IT support and help desk keeps an inventory of your devices and their updates. With our cyber monitoring, automated 24/7 monitoring with on-call technician response flags devices that have stopped receiving their patches.
Book your free cyber check
Not sure how many company devices still run an old version of a calling app? The free cyber check starts there: we review your phones, computers and updates, then hand you a clear plan.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- CVE.org: record CVE-2026-113380 (published October 20, 2026)
- SecurityWeek: Signal Vulnerability Lets Malicious Callers Block Hang-Ups (October 22, 2026)
- ThreatWire: Signal CVE-2026-113380, RingRTC bug can keep calls live after hang-up (app versions derived from Signal’s public source code)
- CyberInsider: Signal fixes critical flaw that could keep audio active after hangup
- GitHub, signalapp/ringrtc: fix « Ensure calls terminate completely in corner cases » (September 4, 2026)
Photo: August de Richelieu, Pexels (Pexels licence).