Avoid saying anything sensitive after ending a Signal call, as a bug in the encrypted messaging app’s calling library might prevent calls from disconnecting fully, leaving video and audio feeds active.

The vulnerability, CVE-2026-113380, was published by MITRE on Tuesday and given a CVSS score of 9.3.

That’s high, so the flaw should be approached as a critical issue in Signal’s open-source RingRTC liberally in every version before 2.72.0.

The app’s update for RingRTC was rolled out last month, but the vulnerability has only been made public now.

“In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call’s FSM (finite state machine) queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down,” said MITRE, an American non-profit maintaining the critical Common Vulnerabilities and Exposures database.

RingRTC is the open-source library behind Signal’s voice and video calling functionality, providing calling components for its mobile and desktop applications.

Essentially, the bug concerns how the library shuts down a call – not how the app encrypts conversations.

In other words, the main concern is unwanted listening after someone believes a call has ended.

The aforementioned flaw description also mentions that video might remain active, too. However, it doesn’t explain what users would see on their screens. It’s also unclear how long any transmission may last.

The vulnerability appears not to have been exploited in the wild and, again, only concerns how a call is shut down. No passwords can be stolen, and no accounts can be compromised.

Still, it’s advised to install any available Signal updates on your devices – if you’re using the app, of course.

The fix appears to allow the Signal call’s FSM to detect termination requests independently of the event queue, while adding a timeout to prevent stalled processing from indefinitely blocking a hangup.

Armed with reliable end-to-end encryption, Signal is widely considered to be the best way to communicate more securely.