Careful what you say after you hang up. The Register reports a critical flaw, CVE-2026-113380 (CVSS 9.3), in Signal’s open-source RingRTC calling library that could keep a call’s audio, and possibly video, active after someone hangs up.
What’s happening
- RingRTC is Signal’s own calling library built on top of WebRTC. The flaw affects every version before 2.72.0.
- It’s essentially a denial-of-service on RingRTC’s finite state machine event queue. If someone on the call saturates the queue with requests, it can fail to process a hangup request, so the call doesn’t end properly.
- The person on the other end may think the call is over while their audio or video channels could still be open.
- Attack complexity is low. A conceptual proof of concept is in a GitHub report. CISA’s exploited-vulnerabilities catalog doesn’t show it being used in the wild.
The fix
Version 2.72.0 lets the state machine detect termination requests independent of the event queue and adds a timeout so stalled processing can’t block a hangup forever. It was pushed out last month, but the vulnerability only became public this week. Signal Desktop’s release history shows RingRTC 2.72.0 was incorporated in September, but it isn’t clear exactly when it reached each platform. The Register has asked Signal for comment.
What to do
- Update Signal on your phone and your desktop to the latest versions.
- Until you know you’re updated, don’t assume a call ended just because the screen says so. Close the app on a call you’re unsure about.
My take
A reminder that encrypted doesn’t mean bug-free. The encryption was fine here, it was call state handling that broke. Update every device you use Signal on, not just the one in your pocket.
Have a blessed day! And Happy Hacking!
