Signal bug could keep your mic - and camera - on after hangup

A critical vulnerability in Signal’s open-source RingRTC calling library, CVE-2026-113380, received a CVSS score of 9.3 and affects versions before 2.72.0. Under certain conditions, a saturated event queue can prevent a hangup request from processing, potentially leaving audio or video active; the fixed version separates termination detection from the queue and adds a timeout. CISA’s known exploited vulnerabilities catalog does not indicate the flaw has been exploited in the wild, and rollout timing across Signal’s platforms remains unclear.

Analysis

This is a product-integrity and rollout-control issue, not evidence that Signal’s encryption has been broken. The economic risk is concentrated in user trust: privacy-sensitive users and organizations may reassess Signal if they cannot verify that every client platform received the fix. That creates a modest, near-term reputational overhang, but there is no basis here to infer material revenue damage or a durable shift to competitors. WhatsApp, Telegram, and other messaging apps could see marginal consideration, though switching costs and the narrow call-teardown failure limit the likely effect.

The key uncertainty is platform-level exposure: confirmation that the fixed library reached Android, iOS, and desktop matters more than the library patch itself. In the next days to weeks, incomplete rollout details or credible exploitation reports could extend negative coverage; independently verified full deployment and no observed exploitation should contain it. Over 6–18 months, the broader signal is whether open-source components used in privacy products have robust release coordination and user-visible version controls—not a demonstrated systemic weakness in WebRTC.

There is no direct listed-company exposure established by the supplied identities, and the article provides no evidence of exploitation or financial materiality. The contrarian read is that the high severity score may overstate investment significance: the failure affects call termination under a specific queue-saturation condition, while the remedy appears to bypass that queue and add a timeout. Avoid treating this as a sector-wide cybersecurity demand catalyst.

Key Decisions for Investors

• No trade recommended: Signal is not a mapped listed issuer, and the facts do not support a measurable earnings or valuation impact for public peers.
• Track confirmation of fixed-version deployment across Android, iOS, and desktop, plus any credible exploitation reports; incomplete rollout or in-the-wild evidence would worsen the trust-risk assessment.
• Do not infer a break in encrypted media or a broad WebRTC vulnerability from this report. Revisit only if independent disclosures show the flaw affects other products or if Signal reports material user or organizational attrition.