Signal Vulnerability Lets Malicious Callers Block Hang-Ups

The vulnerability (CVE-2026-113380, CVSS 9.3) affects RingRTC, an open source calling library based on WebRTC used by Signal for voice and video calls. The flaw arises because the call hangup event is treated as a normal event in the Finite State Machine (FSM) event queue without priority or rate limiting. A remote attacker can flood the FSM event queue with junk events, causing the hangup event to be indefinitely delayed behind attacker-generated noise. As a result, the call does not terminate properly, and audio/video tracks remain active on the victim's device while the user believes the call ended. Signal fixed the issue by ensuring call termination requests are detected independently and do not remain blocked in the FSM event queue. The fix was released in RingRTC version 2.72.0 on September 4, 2026.

An attacker can keep audio and video streams active on a victim's device after the victim has hung up, potentially violating user privacy by continuing to capture microphone and camera data without user awareness. The victim believes the call ended, but the media tracks remain flowing. This could lead to unauthorized audio/video surveillance.

The vulnerability has been officially fixed in RingRTC version 2.72.0. Users should update their Signal applications to versions that include this patched library as soon as possible. If unable to update immediately, users should verify the call indicator to confirm that calls have actually ended. No other mitigation is indicated by the vendor advisory.