Messenger Fail: Signal bug makes listening possible, update started
A software error in Signal could cause the microphone and camera to remain on after hanging up. Attackers could eavesdrop on conversations even though the call appears to have ended. A saving update is already available.
Critical call error
The CVE-2026-113380 vulnerability affects the way the application drops connections. If a user hangs up, the other party can block it. The issue is considered critical with a CVSS score of 9.3. The cause is the open source library RingRTC, which controls the voice and video functions. It is based on WebRTC technology introduced in 2011. An attacker can overload the internal queue with a flood of requests. This means that the audio transmission continues unnoticed while the victim believes that the call has already ended.
Built-in protection on Android
How about signal citing a Signal spokesman, the incorrect behavior could only be reproduced under the Android mobile operating system. To exploit the flaw, an attacker would have to be on an active call with the victim. Because Signal blocks calls from unknown contacts by default, an attack requires that the people are already connected via an accepted message request or are in a group chat. This protective function has been part of the application for many years and makes it much more difficult to easily exploit it. Additionally, Android shows in the status bar when an application accesses the microphone or camera. Users could recognize that hardware components are still active. There have been no reports of attacks so far.
Patch is ready
The developers have updated the faulty library. The system now processes the hangup command independently of the event queue. In addition, a new time limit prevents blocked processes from permanently holding up the completion of a conversation. This closes the gap in the internal processes of the software. The fix is in the Signal version 8.27 for Android included, which is already being distributed. As part of the weekly cycle, the application has now been updated to version 8.33. Signal advises keeping the app up to date on all devices.
