security

Careful what you say after goodbye, or better yet, update your messaging app

Make sure you don’t say anything mean or secret after hanging up a call on Signal, as a bug in the encrypted messaging app’s calling library could prevent a call from ending properly, potentially leaving audio and possibly video active.

The vulnerability, CVE-2026-113380 , was published by MITRE on Tuesday and given a CVSS score of 9.3, marking it as a critical issue in Signal’s open-source RingRTC library in every single version before 2.72.0. That update was pushed out last month, but the vulnerability wasn’t made public until now.

RingRTC is Signal’s own calling library built on top of WebRTC , a technology introduced in 2011 that has since become widely used for voice and video communication over the internet.…