A critical vulnerability in Signal’s calling library could allow a malicious participant in a call to continue receiving audio after another user attempts to hang up.
Tracked as CVE-2026-113380, the flaw affects RingRTC versions prior to 2.72.0 and has a CVSS score of 9.3. The published description also notes that video could potentially remain active, although that behavior is not confirmed.
RingRTC provides the voice and video calling functionality used by Signal’s mobile and desktop apps. The bug affects how calls are shut down, not Signal’s encryption: a secure connection might remain open and continue carrying private audio if the software fails to close it when the user presses the end-call button.
How the vulnerability works
The issue stems from an internal event queue used by RingRTC’s finite-state machine (FSM), which tracks a call’s state and handles instructions that control call operations. A malicious participant in the same call can overwhelm that queue, interfering with the steps required to terminate the call and preventing a local hang-up from fully stopping audio transmission.
The attack requires being a participant in the call; it is not described as a method for an unrelated remote attacker to turn on a Signal user’s microphone. Public reports leave some details unresolved, such as exactly what users would see on-screen and how long any unwanted transmission might continue.
The researcher published a Python demonstration that simulates how queued events can block hang-up handling, but the demo runs offline and does not attack Signal or prove real-world exploitation.
Fix and mitigation
RingRTC 2.72.0 addresses the problem by reducing dependence on the overloaded event queue when terminating calls. The update adds a separate termination flag that the call and connection state machines can check independently, and it introduces five-second limits for shutdown waits so cleanup can proceed when individual steps fail.
Tests described in the patch verify behavior when queues are full and when application notifications fail. They confirm that hang-up closes the simulated connection, stops outgoing audio, and clears the component that handles outgoing media packets. The change strengthens shutdown behavior; it does not alter Signal’s end-to-end encryption.
Signal users should install available updates on every phone and computer they use. Developers who build applications with RingRTC should upgrade to version 2.72.0 or later. Note that the library version is not the same as an app version, and public reports did not identify the first fixed Signal app version for every platform.
This vulnerability is distinct from previously reported Signal issues that targeted linked-device access or used support-impersonation to extract registration details; those incidents used different attack methods and are unrelated to this call-shutdown failure.
There are no reported confirmed exploitations of this flaw. Nevertheless, the possibility is relevant for sensitive conversations: updating removes the software risk, and as a practical precaution users should check that call and microphone indicators have stopped before discussing private matters nearby.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
