Update Signal to Stop Attackers From Keeping Calls Alive After Hang-Up

Signal has patched a critical vulnerability in its underlying calling infrastructure that allowed attackers to maintain access to a user's audio and video streams after the user believed they had ended a call. The flaw, tracked as CVE-2026-113380, resides in RingRTC, the open-source library based on WebRTC that Signal utilizes for voice and video communications. According to SecurityWeek, the defect carried a CVSS score of 9.3, classifying it as critical severity.

The risk

The vulnerability stemmed from how RingRTC handled call termination events within its Finite State Machine (FSM). Instead of treating a hangup command as an immediate kill switch, the system added the hangup event to a queue alongside other peer-originated events. Because there was no rate limiting on these events and no priority assigned to the hangup command, a malicious caller could flood the queue with junk data. This caused the legitimate hangup request to wait indefinitely behind the attacker's noise.

As a result, the call session never properly terminated on the victim's device. The audio and video tracks remained active, allowing the attacker to continue receiving data from the target's microphone and potentially their camera. The victim, seeing the call interface close, would assume the conversation had ended while the data leak continued unnoticed. This behavior bypassed standard user expectations for call privacy and termination.

Who is exposed

This issue specifically affects users of the Signal application who rely on its voice and video calling features. Since Signal uses RingRTC for these functions, any version of the application containing the vulnerable RingRTC library prior to the fix was at risk. The exposure is remote, requiring only that a malicious actor initiate a call to the victim. The flaw does not require the victim to install additional software or click on links, making it a significant threat to users engaging in real-time communication.

Cost and compliance

SecurityWeek reported that the vulnerability was resolved in RingRTC version 2.72.0, which was released on September 4. The details of the flaw, along with a conceptual proof-of-concept, were published on Tuesday, and the National Institute of Standards and Technology added the CVE to the National Vulnerability Database on the same day. Signal addressed the issue by ensuring call termination requests are detected independently and do not remain blocked in the FSM event queue.

Our take on the response

Signal’s fix fundamentally changes how the application handles termination signals, moving from a queued event model to an independent detection mechanism. This architectural shift prevents attackers from using queue flooding to delay or block the hangup process. For security teams, this highlights the importance of reviewing how critical control signals are prioritized in state machines, especially in real-time communication protocols where latency and queue management can introduce security gaps.

What defenders should look for

Teams usually monitor for abnormal call durations or sessions that persist despite user-initiated disconnect signals. Check whether endpoint logs show active audio or video streams continuing after a hangup event is recorded. Look for indicators of queue saturation or unusual event rates in communication libraries during active calls. First containment moves involve forcing application restarts to clear stuck sessions and verifying that all endpoints are running patched library versions.

What to do and how to stay safe: Signal

• Update Signal applications immediately to the latest version that includes RingRTC 2.72.0 or newer to mitigate the vulnerability.
• Verify that call indicators on devices accurately reflect the status of active sessions to ensure users are aware of ongoing connections.
• Monitor system resources for unexpected microphone or camera activity that persists after calls are ostensibly ended.
• Review application logs for signs of event queue flooding or abnormal termination delays during voice or video calls.

Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-113380?

It is a critical-severity vulnerability in the RingRTC library that allows attackers to prevent call termination by flooding the event queue.

How did the attacker exploit this flaw?

The attacker flooded the FSM event queue with junk data, causing the hangup event to wait indefinitely and keeping audio and video tracks active.

When was the fix released?

The fix was included in RingRTC version 2.72.0, which was released on September 4.