Signal has resolved a critical-severity vulnerability that could allow a malicious caller to keep audio and video tracks enabled even after the user hung up.
The security defect is tracked as CVE-2026-113380 (CVSS score of 9.3) and impacts RingRTC, the open source library Signal uses for voice and video calls, which is based on WebRTC.
Due to the issue, a remote peer could flood the call’s Finite State Machine (FSM) event queue with junk, and the call would not terminate.
This happened because the hangup was not treated as a kill switch, but as an event added to the FSM event queue; there was no rate limit on peer-originated events; and the hangup event had no priority.
“Flood the queue with junk and the hang-up waits behind attacker noise forever, so the call (microphone, possibly camera) is never torn down,” a GitHub write-up by a researcher reads.
By exploiting the vulnerability, an attacker could keep the audio and video tracks flowing from a target device while the victim believes they ended the call.
The security defect was resolved in RingRTC version 2.72.0, which was released on September 4.
Details on the flaw, however, were published on Tuesday, along with a conceptual proof-of-concept (PoC). NIST added the CVE to the NVD database on Tuesday.
Signal resolved the issue by ensuring that call termination requests do not remain blocked in FSM’s event queue and are detected independently.
Users should update their Signal applications as soon as possible. Otherwise, they should check the call indicator to make sure the call indeed ended.
Related: Splunk, SolarWinds Release Fresh Security Updates
Related: Cisco Patches 34 Vulnerabilities Across Multiple Products
Related: PHP2Shell Exploitation Started Days Before Patches
Related: High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
