A CVE-2026-113380 vulnerability in Signal allows the microphone and camera to remain active after a call ends. The flaw affects versions of the open-source RingRTC library prior to 2.72.0, which powers the app's calling functionality.
The vulnerability is rated as low complexity to exploit, meaning attackers could relatively easily trigger the issue. Signal users should update to the latest version on both mobile and desktop to patch the problem and prevent potential privacy leaks through lingering hardware access.