The call ended. The microphone, maybe not.

CVE-2026-113380 carries a severity score of 9.3 out of 10, which is steep even on a scale that hands out big numbers freely. What it describes is unsettling in a quiet way. Signal's calls run on an open-source library called RingRTC, and inside it sits a queue that holds up to 256 pending events. Another person on the call can flood that queue. Your "hang up" is just another event, so it waits in line behind the flood, arrives late, or never arrives at all. The call window closes. The audio track, and possibly the video track, stays alive.

A few things belong in proportion here. The encryption is untouched, so nobody was reading your messages and nobody needs to reset a password. There is no sign of this being used against anyone in the wild. And it is not a stranger on the internet: whoever pulls it off has to be in the call with you already, which narrows the realistic case to someone who talked their way into a group call. Signal's fix, committed on 4 September by one of its developers, adds a separate termination flag that the call machinery checks on its own, plus a five-second limit on shutdown so the teardown finishes even when something jams.

The repair shipped in RingRTC 2.72.0 and the Signal builds on top of it. Signal has not published a tidy table of exactly which client versions carry it, so the practical answer is to update the app everywhere you use it. Phone, tablet, and the Windows desktop client in particular, which people forget about because it sits in the background running happily for months.

Keeping desktop apps current is precisely the dull chore a bug like this punishes. Tendvane's app updater checks what you have installed against winget and brings it all up to date in one pass, Signal Desktop included.