A critical vulnerability in Signal's open-source RingRTC calling library could prevent calls from terminating normally, potentially leaving the microphone or camera active after a user thinks the call has ended. Tracked as CVE-2026-113380, the issue carries a CVSS score of 9.3 and affects every RingRTC version before 2.72.0. Signal pushed that fix last month, but the vulnerability was only made public this week.
The problem is essentially a denial-of-service attack on RingRTC's finite state machine event queue, which manages events during a call. If one participant saturates the queue with requests, it can become overwhelmed and fail to process a hangup, so the call never actually terminates. A conceptual proof of concept is available, using a Python script to simulate how flooding prevents hangup processing. Attack complexity is considered low, and there is no indication the flaw has been exploited in the wild.
Signal's fix lets the finite state machine detect termination requests independently of the event queue and adds a timeout to prevent stalled processing from indefinitely blocking a hangup. The exact rollout timing across Android, iOS, and desktop remains unclear, though Signal Desktop incorporated the fixed RingRTC version in September. Until users confirm they are updated, the safe move is to update both mobile and desktop apps and to watch what is said after pressing the hangup button.