Critical Signal Call Bug Lets Attackers Keep Mic and Camera Live After Hang‑Up

A newly disclosed flaw in Signal's voice‑and‑video calling library could allow a malicious caller to keep a conversation active even after the intended participant has ended the call, potentially leaving the microphone or camera exposed without the user's knowledge.

The issue, catalogued as CVE‑2026‑113380 and assigned a CVSS rating of 9.3 out of 10, stems from improper handling of the termination signal that should close media streams. Exploiting the bug, an attacker can retain control of the call session, maintaining access to audio and video feeds long after the legitimate user believes the call has ended.

Technical analysis shows that the calling component fails to verify that the remote endpoint has acknowledged the hang‑up request before releasing resources. As a result, a crafted payload from the opposing party can bypass the shutdown routine, keeping the underlying media pipeline open. The vulnerability is confined to the call‑handling library but affects all platforms that run the official Signal client.

Signal boasts an estimated user base in the hundreds of millions, many of whom rely on the app for encrypted communication in high‑risk environments. A breach of this nature could compromise personal safety, expose sensitive conversations, and erode confidence in a tool that has become a cornerstone of modern digital privacy.

Signal's development team responded quickly, publishing a patched version of the app within days of the report. Users are urged to update to the latest release immediately, verify the version number in the app settings, and consider reinstalling if automatic updates are disabled. The fix disables the vulnerable code path and adds stricter validation of call‑termination messages.

The episode underscores the constant pressure on secure‑messaging providers to identify and remediate flaws before they can be weaponized. It also highlights the role of independent security researchers and outlets like Security Affairs in bringing such issues to light. As the ecosystem evolves, timely patching and user vigilance remain essential to preserving the confidentiality and integrity that Signal promises.