Signal RingRTC flaw keeps audio flowing after hang-up

CVE-2026-113380, published by MITRE on Oct. 20, 2026, is a vulnerability in Signal’s RingRTC calling library that lets the other party on a call keep receiving a user’s audio, and possibly video, after the user hangs up. The flaw, scored at 9.3 on the CVSS scale, affects RingRTC versions before 2.72.0 and reaches every Signal client on Android, iOS and Desktop until each client ships the fixed library. RingRTC is the open source library that powers voice and video calls in Signal’s apps, and WebRTC underlies it. WebRTC is a technology introduced in 2011 and widely used for internet voice and video communication.

The vulnerability exploits how RingRTC manages call termination. A researcher publishing notes on GitHub under the name Imahian documented the issue, describing a local hang-up as an event placed at the back of the call’s finite-state-machine (FSM) queue, with no rate limit on peer-originated events and no priority lane for hang-up. FSM components process events through bounded queues, each with a capacity of 256 entries.

A conceptual proof of concept floods the call’s event queue with junk so a victim’s hang-up stalls and media keeps flowing. Older builds could halt a failed shutdown step before the remaining cleanup steps ran. The attack requires a malicious participant already on the call and is not described as a way for an unrelated outsider to turn on a Signal user’s microphone.

If triggered, the flaw could let a malicious call participant keep hearing audio the other person no longer intended to share, such as an offhand remark, a conversation with someone nearby, or other private background sound. Because the software drops the hang-up command, the interface may show the call ended while audio and possibly video capture continues. The flaw concerns how a call shuts down, not how Signal encrypts conversations; an encrypted connection can still carry private audio if the software fails to close it. Application-layer flaws can undermine even end-to-end encrypted media channels.

RingRTC 2.72.0, released on Sept. 4, 2026, adds a separate termination flag that call and connection state machines check independently, plus five-second limits on shutdown waits. Signal developer jim-signal authored the corrective commit on Sept. 4, describing it as ensuring complete call termination in exceptional circumstances. Signal resolved the issue by ensuring call termination requests do not remain blocked in the FSM event queue and Signal detects them independently. The patch lets cleanup proceed when shutdown waits or other termination operations fail, and new tests check that hang-up closes the connection, turns off outgoing audio and clears the outgoing media packet component.

The fix was available roughly a month before publication of the CVE and technical details; clients that updated after the September release carry the fix, while those that did not remain exposed. The Register reports Signal pushed out fixed RingRTC 2.72.0 last month and incorporated it into Signal Desktop in September, with Android and iOS rollout dates unclear. Malwarebytes reported finding a Google Play Store update bringing its Android app to version 8.32.2, with no update found in the Apple App Store and an iPad listed as 8.32 (1910), hard to confirm from Signal’s website.

The affected and first-fixed Signal app versions have not been confirmed publicly. CyberInsider contacted Signal about which client versions are impacted but had not received a response by publication time, and requests for clarification to Signal were unanswered at time of publication. The reporting does not say how many users were still running a pre-2.72.0 build or which app builds bundle which RingRTC release.

No known reports show exploitation in the wild, and CISA has not added CVE-2026-113380 to its Known Exploited Vulnerabilities catalog. The National Vulnerability Database lists the CVE as awaiting analysis. A conceptual proof of concept on GitHub uses a Python script to simulate flooding the event queue, with no evidence that anyone used the technique against Signal users in the wild.

CWE-754 classifies the weakness as improper checking for unusual or exceptional conditions, with low attack complexity. The CVSS rating describes a network attack with low complexity and no privileges required, rating confidentiality and integrity impact as high and availability impact as none. The published description does not confirm that video remains active.

Users should update Signal applications as soon as possible or check the call indicator to confirm the call ended. It does not take passwords, compromise accounts or expose message histories, so no password reset is needed.