Signal flaw could keep audio and video flowing after users hang up

A critical vulnerability in RingRTC, the open source library that powers voice and video calls in Signal, could let a malicious caller prevent a victim from ending a call, keeping audio and possibly video flowing from the victim's device after they believe they have hung up. The flaw, tracked as CVE-2026-113380 with a CVSS score of 9.3, was published this week and is fixed in RingRTC 2.72.0, according to SecurityWeek and Help Net Security.

What happened

According to Help Net Security, MITRE published the CVE record on October 20, 2026. SecurityWeek reported that details and a conceptual proof of concept were published on Tuesday by a researcher in a write-up on GitHub, and that NIST added the CVE to the National Vulnerability Database the same day. Help Net Security identified the researcher by the GitHub name Imahian. Neither publication included a statement from Signal beyond describing the fix.

Technical details

RingRTC is built on WebRTC and handles call state through a finite state machine with an event queue. The CVE record says a peer that saturates this queue can prevent a local hang-up from tearing the call down, Help Net Security reported. SecurityWeek described three design issues that combined to make this possible: the hang-up was processed as an ordinary queued event rather than an immediate kill switch, events originating from the remote peer were not rate-limited, and hang-up events had no priority.

In the conceptual scenario, an attacker places a normal call and floods the event queue so the victim's hang-up gets stuck behind the backlog. As a result, the victim's microphone, and possibly camera, could keep transmitting while the victim believes the call has ended. Help Net Security said the CVSS 4.0 vector rates the attack as network-based, low complexity and requiring no privileges, with high confidentiality and integrity impact.

Signal changed the code so that call termination requests are no longer blocked in the event queue and are detected independently, SecurityWeek said.

Who is affected

Help Net Security reported that RingRTC versions before 2.72.0 are vulnerable and that the issue affects Signal clients on Android, iOS and Desktop that embed an older build. SecurityWeek said RingRTC 2.72.0 was released on September 4, meaning current Signal releases should already include the fix. There are no known reports of exploitation in the wild, and the flaw has not been added to CISA's Known Exploited Vulnerabilities catalog.

What to do

Users should make sure Signal is updated to the latest version on every device used for calls, including desktop installations that may update less frequently. Until devices are updated, SecurityWeek advised checking the in-app call indicator to confirm that a call has actually ended. Organizations that rely on Signal for sensitive communications should verify client versions across managed devices.