{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "signal-desktop-call-hang-up-bug",
  "url": "https://patchgap.ai/incidents/signal-desktop-call-hang-up-bug/",
  "path": "/incidents/signal-desktop-call-hang-up-bug/",
  "json_url": "https://patchgap.ai/incidents/signal-desktop-call-hang-up-bug.json",
  "title": "Signal Desktop: update so calls end when you hang up",
  "category": "apps",
  "platforms": [
   "windows",
   "macos",
   "linux"
  ],
  "products": [
   "signal-desktop"
  ],
  "status": "patched",
  "status_label": "Patched: update now",
  "severity": "critical",
  "severity_source": "NVD score 9.3 out of 10 (not yet fully reviewed by NVD).",
  "exploited_in_wild": "unknown",
  "exploited_note": "No report that anyone is using this bug.",
  "exploited_source_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113380",
  "confidence": "unconfirmed",
  "confidence_note": "NVD names the Signal call library (RingRTC), not each Signal app. Signal Desktop uses this library, so it is very likely affected, but Signal has not published a notice we could find.",
  "first_reported": "2026-10-20",
  "updated_at": "2026-10-27",
  "cves": [
   "CVE-2026-113380"
  ],
  "summary": "Signal's calling code had a bug. Someone on the other end of a call could overload it so your 'hang up' did not fully end the call. News reports said your microphone or camera could stay on. Signal fixed the calling code in version 2.72.0, and Signal Desktop 8.31.0 and newer include the fixed library.",
  "am_i_affected": "You may be at risk if you use Signal Desktop older than 8.31.0. Open Signal and check Help > About Signal Desktop. We have only checked 8.31.0 and later, so an earlier version might also be fixed, but we cannot confirm it.",
  "action": "Update Signal Desktop to 8.31.0",
  "affected": [
   {
    "product": "signal-desktop",
    "product_name": "Signal Desktop",
    "platform": "windows",
    "affected_versions": "Signal Desktop older than 8.31.0 (earlier builds not checked)",
    "fixed_version": "8.31.0",
    "fixed_min": "8.31.0",
    "fix_note": null,
    "fixed_source_urls": [
     "https://github.com/signalapp/Signal-Desktop/blob/v8.31.0/package.json",
     "https://github.com/signalapp/Signal-Desktop/blob/v8.32.0/package.json"
    ],
    "check": {
     "menu_path": "Open Signal. Windows and Linux: Help > About Signal Desktop. Mac: Signal > About Signal Desktop.",
     "command": "Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*' -ErrorAction SilentlyContinue | Where-Object DisplayName -like '*Signal*' | Select-Object DisplayName,DisplayVersion",
     "shell": "PowerShell",
     "read_only": true
    },
    "official_download": "https://signal.org/download/"
   },
   {
    "product": "signal-desktop",
    "product_name": "Signal Desktop",
    "platform": "macos",
    "affected_versions": "Signal Desktop older than 8.31.0 (earlier builds not checked)",
    "fixed_version": "8.31.0",
    "fixed_min": "8.31.0",
    "fix_note": null,
    "fixed_source_urls": [
     "https://github.com/signalapp/Signal-Desktop/blob/v8.31.0/package.json",
     "https://github.com/signalapp/Signal-Desktop/blob/v8.32.0/package.json"
    ],
    "check": {
     "menu_path": "Open Signal. Menu bar: Signal > About Signal Desktop.",
     "command": "defaults read \"/Applications/Signal.app/Contents/Info\" CFBundleShortVersionString",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://signal.org/download/"
   },
   {
    "product": "signal-desktop",
    "product_name": "Signal Desktop",
    "platform": "linux",
    "affected_versions": "Signal Desktop older than 8.31.0 (earlier builds not checked)",
    "fixed_version": "8.31.0",
    "fixed_min": "8.31.0",
    "fix_note": null,
    "fixed_source_urls": [
     "https://github.com/signalapp/Signal-Desktop/blob/v8.31.0/package.json",
     "https://github.com/signalapp/Signal-Desktop/blob/v8.32.0/package.json"
    ],
    "check": {
     "menu_path": "Open the app and look in its Help or About menu, or check your software manager.",
     "command": null,
     "shell": null,
     "read_only": null
    },
    "official_download": "https://signal.org/download/"
   }
  ],
  "fix_steps": [
   "Open Signal Desktop. It normally updates itself and asks you to restart.",
   "If it did not, download the newest version from signal.org.",
   "Check Help > About Signal Desktop shows 8.31.0 or newer.",
   "When a call ends, check that your microphone and camera lights go off."
  ],
  "official_patch_links": [
   {
    "label": "Signal: official download",
    "url": "https://signal.org/download/"
   }
  ],
  "extra_checks": [],
  "sources": [
   {
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113380",
    "title": "NVD: CVE-2026-113380 (RingRTC before 2.72.0)",
    "date": "2026-10-20",
    "kind": "nvd",
    "official": true
   },
   {
    "url": "https://github.com/signalapp/Signal-Desktop/blob/v8.31.0/package.json",
    "title": "Signal Desktop v8.31.0 package.json (uses RingRTC 2.72.1)",
    "date": "2026-10-15",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://github.com/signalapp/Signal-Desktop/blob/v8.32.0/package.json",
    "title": "Signal Desktop v8.32.0 package.json (uses RingRTC 2.72.1)",
    "date": "2026-10-20",
    "kind": "vendor",
    "official": true
   }
  ]
 }
}