Signal RingRTC flaw CVE-2026-113380 leaves microphone and possibly camera active after call ends

On September 4, Signal developer jim-signal authored a commit to fix CVE-2026-113380 in the RingRTC calling library. The flaw carries a CVSS score of 9.3, which CyberInsider describes as CVSS v4.0, and lets a malicious call participant saturate the call’s finite-state-machine event queue and block a local hang-up. That can leave the microphone and possibly the camera active after the user believes the call ended.

RingRTC is Signal’s calling library. The queue holds 256 entries. It treats hang-ups as ordinary events and has no rate limit or priority lane for events from other participants. RingRTC runs on WebRTC, the calling technology introduced in 2011.

The published description does not confirm that video remains active. Reporting has not established what affected users would see onscreen or how long unwanted transmission might continue. The flaw does not break Signal’s end-to-end encryption. It also does not involve stolen passwords, compromised accounts, or exposed message histories, so no password reset is needed.

RingRTC versions earlier than 2.72.0 are affected. CSIRT Toscana names Signal for Android before 8.27.0, Signal for iOS before 8.30.0, and Signal Desktop before 8.29.0 in its list of affected builds. Other reviewed coverage has not publicly confirmed the affected and first-fixed app versions, leaving the exact client exposure uncertain. Signal Desktop incorporated the fixed build in September, but Android and iOS rollout dates are unclear.

A reporter for Malwarebytes saw Android version 8.32.2 listed in the Google Play Store, and the reporter’s iPad displayed version 8.32 (1910), but Signal’s website did not confirm the patch status. The number of installations running affected RingRTC builds is not publicly known.

In-the-wild exploitation has not been confirmed, and the CISA known exploited vulnerabilities catalog does not include this vulnerability. Low attack complexity is listed in the CVE record, and the likely attack vector is remote and comes through a malicious call peer. CVE Brief marks public exploit availability as false, and the published proof of concept is an offline Python simulation rather than a working exploit targeting live clients. The attack requires a malicious participant in the call, not an unrelated outsider.

Daily Security Review says MITRE published CVE-2026-113380 on October 21, 2026, while OSINTSights and SecurityWeek date disclosure to Tuesday. The sources disagree on the public disclosure date. Signal did not answer The Register’s requests for clarification at publication, and CyberInsider received no response from Signal about affected client versions by publication.

This issue is not the same as earlier Signal linked-device attacks and support impersonation campaigns. This issue falls under CWE-754, which covers improper checking for unusual or exceptional conditions. CVE Brief assesses the risk to privacy and organizational confidentiality as severe. Security Affairs says ending a call must work as an immediate control action, and traffic from the other participant should not delay it.

RingRTC 2.72.0 adds a termination flag that the call and connection state machines check independently. It sets five-second limits on shutdown waits so cleanup proceeds when steps fail, and the regression tests cover saturated queues and failed application notifications.

Enterprises need to verify that deployed Signal clients include RingRTC 2.72.0 or later and should also require proof of RingRTC 2.72.0 inclusion in vendor change logs before sensitive use. Developers who integrate RingRTC should use version 2.72.0 or later. Users are advised to install the latest Signal release and check that call indicators show the call ended.