RingRTC · Disclosed

Signal fixes flaw that kept mic and camera on after hangup

Oct 19, 2026 · 1 min read

A critical flaw in Signal's RingRTC calling library (CVE-2026-113380, CVSS 9.3) let the other party keep audio and possibly video active after the user hung up, by saturating the call's event queue. The fix shipped in RingRTC 2.72.0, incorporated into Signal Desktop in September according to The Register, and there are no reports of exploitation in the wild. Update Signal on every device used for calls.

By HIFY Radar newsroom Updated 10/26/2026 01:20 PM Get this every day →← Back to the feed 5 sources

HighVulnerabilityDisclosedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Signal fixed a flaw (CVE-2026-113380, CVSS 9.3) in its RingRTC calling library. A malicious caller could block proper call termination: the user hung up, but the microphone and possibly the camera stayed live with the other party.

Why it matters

Anything said after hanging up could be captured without notice, exposing sensitive information from anyone using Signal calls on Android, iOS and Desktop. Sources report no exploitation in the wild so far, but a proof of concept is already public.

What to do

Update Signal on every device, mobile and desktop. Confirm each client is on the latest version, since the fix depends on RingRTC 2.72.0 being embedded in the app.

For the technical team

CVE: CVE-2026-113380
Affected: RingRTC, biblioteca de chamadas do Signal (@signalapp/ringrtc) · RingRTC before 2.72.0; every Signal client embedding an older build of the library: Android, iOS and Desktop.
Exploitation: No reported exploitation in the wild; CISA has not added the flaw to its KEV catalog and NVD lists it as awaiting analysis. A conceptual proof of concept exists, a Python script simulating queue flooding, documented by researcher Imahian in a GitHub write-up.
Fix: RingRTC 2.72.0. Per the commit, the FSM now detects termination requests independently of the event queue (terminate_requested flag), with a 5-second timeout (TERMINATE_TIMEOUT) to tear the call down even if processing stalls. Signal Desktop incorporated RingRTC 2.72.0 in September according to The Register; exact rollout dates on other platforms remain unclear.
Vector: Signal's RingRTC library (built on WebRTC), flaw classified as CWE-754. The call's finite state machine (FSM) event queue accepts peer-originated events with no rate limit and no priority lane for hang-up; the attacker, already on a call with the victim, floods the queue with junk and the local hang-up gets stuck behind the backlog. Network attack, low complexity, no privileges required. The victim believes the call ended while audio and possibly video keep flowing.
More details: CVE-2026-113380 published by MITRE on 2026-10-20, CVSS 4.0 of 9.3: high impact on confidentiality and integrity, none on availability. The attacker places an ordinary call and floods the queue; the local hang-up is just one more event placed at the back of the queue. The Register states the update was pushed out in September, a month before public disclosure.