Signal hang-up bug (CVE-2026-113380): update the app on every device

Image: Official Signal logo (signal.org) on Signal brand blue.

You hang up a Signal call. The UI looks idle. Your microphone should be off. For older builds of Signal’s calling stack, that assumption was weaker than it should have been.

CVE-2026-113380 covers a flaw in RingRTC, the open-source library Signal uses for voice and video calls. The NVD record and GitHub advisory GHSA-5c63-xm6f-r368 describe it this way: in RingRTC before 2.72.0, a call peer that saturates a call’s finite-state machine (FSM) event queue can interfere with a local hang-up tearing the call down, so audio (and perhaps video) may keep flowing. The CVE was published on October 20, 2026 (2026-10-20T05:16:54Z, or 1:16 AM EDT). The library fix shipped earlier, on September 4, 2026, in RingRTC 2.72.0 (commit 4b1b6fa).

This is a personal-device problem. If you use Signal for family calls, mutual-aid groups, or private chats, update the app on every phone, tablet, and desktop you use.

What the bug is (and is not)

Is

• A problem in how a call shuts down (tracked under CWE-754, improper check for unusual or exceptional conditions), not in Signal’s message or media encryption.
• Something that requires you to already be in a Signal call with the other party. It is not a way to open your microphone from across the internet with no call.
• Rated CVSS 4.0 9.3 (Critical) on the CVE record (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:N/SA:N/S:P). Treat that as a strong nudge to update, not as proof someone already targeted you.
• Covered in independent write-ups after disclosure, including SecurityWeek (October 22) and Malwarebytes (October 21).

Is not

• A reason to reset your Signal PIN or re-register your phone number. The flaw does not expose account credentials or message history.
• Known to be exploited in the wild. CISA’s coordinator assessment on the CVE record lists exploitation: none, and the CVE is not in the CISA KEV catalog. Still update.

In RingRTC before 2.72.0 (v2.71.0...v2.72.0 comparison), call and connection state machines processed events through bounded 256-entry queues, and the termination sequence could return early if queuing a termination event or notifying the app failed. Signal’s September 4 fix (commit 4b1b6fa, listed in the RingRTC changelog as “Ensure calls terminate completely in corner cases”) adds an independent termination flag checked outside the event queue, caps FSM shutdown waits at five seconds, and continues cleanup even if an earlier termination step fails.

Fixed library version, and what that means for your apps

The authoritative library boundary is clear:

• Affected: RingRTC before 2.72.0
• Fixed: RingRTC 2.72.0 and later (released September 4, 2026)

Signal has not posted a standalone advisory page on signal.org, but Signal’s official public source tags show the exact first app releases that bumped RingRTC from 2.71.0 to 2.72.0:

• Signal Android: 8.27.0 (org.signal:ringrtc-android:2.72.0, up from 2.71.0 in v8.26.0)
• Signal iOS: 8.30 (build 8.30.0.1882) (SignalRingRTC 2.72.0)
• Signal Desktop: 8.29.0 (@signalapp/ringrtc 2.72.0, up from 2.71.0 in v8.28.0)

Current October 2026 Signal releases on all three platforms are already several versions past those September builds (bundling RingRTC 2.72.1 or 2.73.0). Practical home guidance: install the latest Signal build from the official store on every device. If a phone, tablet, or desktop is still sitting on an August or early-September build, update it now.

How to update and verify on your devices

Android

1. Open the Google Play store (or the store you used to install Signal; prefer Play or Signal’s official Android distribution, not a random APK site).
2. Update Signal.
3. Open Signal once so the new build actually launches.
4. Check the version: Signal -> your profile -> Settings -> scroll to the bottom (or Help / About, depending on build). Confirm it is 8.27.0 or newer.
5. If Play offers no update and you are far behind, confirm you are signed into the correct Play account and that automatic updates were not paused for Signal.

iPhone / iPad

1. Open the App Store -> profile -> Updates, or open Signal’s App Store page.
2. Update Signal.
3. Open the app once.
4. Confirm the version under Signal -> Settings -> Help (or the version line at the bottom of Settings) is 8.30 or newer.

Signal Desktop (Windows, Mac, Linux)

1. Open Signal Desktop.
2. Use the in-app update prompt if it appears, or download the current installer only from signal.org/download.
3. Fully quit Desktop and relaunch after updating.
4. Check Help -> About Signal (or Signal -> About Signal Desktop on macOS) and confirm the version is 8.29.0 or newer.

Update the phone and the desktop. Patching one does not patch the other. A secondary tablet or spare laptop at home still counts.

While you are updating: a one-minute call hygiene habit

Even on a fixed build, get used to confirming the call really ended:

1. After you hang up, glance at the Signal call indicator / in-call UI until it is gone.
2. On phones, check the status bar or Dynamic Island / ongoing-call chip if your OS shows one.
3. If anything still looks “in call,” force-close Signal from the app switcher and lock the screen.

That habit is cheap. It is also what SecurityWeek recommends if you cannot update immediately.

Do this / don’t do that

Do

• Update Signal from official stores on every device you use for calls.
• Prefer current releases over “it still works, I’ll update later.”
• After a sensitive call, confirm the UI shows idle before you keep talking in the room.

Don’t

• Do not sideload Signal APKs from random websites to “get the fix faster.”
• Do not assume message encryption somehow made this calling bug irrelevant. Different layer.
• Do not only update the phone you hold right now and ignore the old tablet or the desktop install at home.

Bottom line

CVE-2026-113380 is a RingRTC hang-up teardown bug fixed in RingRTC 2.72.0 (September 4, 2026) and published to NVD on October 20, 2026 (NVD, GHSA-5c63-xm6f-r368). On your own devices: update Signal everywhere (at least Android 8.27.0, iOS 8.30, and Desktop 8.29.0, or simply the latest release), relaunch it, and make a habit of confirming the call UI is actually idle after you hang up.