Signal: Security Flaw Left Calls Open After Hanging Up

A malicious call participant could prevent calls from being fully terminated due to a bug in the RingRTC library. An update resolves the issue.

A critical security vulnerability was discovered in the RingRTC library, which handles voice and video calls in the Signal messenger. A malicious call participant could use it to prevent a call from being completely terminated after hanging up. Audio and potentially video from the other participant continued to be transmitted, even though that person believed the call had ended. The vulnerability, designated CVE-2026-113380, affects RingRTC versions prior to 2.72.0 and is rated critical with a CVSS 4.0 score of 9.3. The US organization MITRE published the entry.

“A participant saturating the FSM queue of a call can prevent a local hang-up from terminating the call (with its audio and potentially video track).”

MITRE

Overloaded Queue Blocks Hanging Up

RingRTC is built on WebRTC technology and manages calls via a finite state machine (FSM) that processes events in a queue. If a participant floods this queue with requests, the command to hang up gets stuck behind them. According to a conceptual proof of concept by discoverer Imahian, the attacker initiates an ordinary Signal call and subsequently overloads the queue. The vulnerability does not affect Signal’s encryption, but only call termination. It can only be exploited by a participant in the call, not by third parties intercepting encrypted traffic. There is no evidence of exploitation in the wild.

Update Already Released in September

A Signal developer had already submitted the fix on September 4. In version 2.72.0, the state machine recognizes termination requests independently of the queue. In addition, a timeout prevents blocked processing from permanently preventing hang-ups. New tests verify that hanging up closes the connection, mutes outgoing audio, and terminates media data transmission.

According to the analysis, all Signal apps for Android, iOS, and desktop containing an older version of RingRTC are affected. Signal has not specified in detail which app versions contain the fix. Users should update their Signal apps to the latest version on all devices.

(Editorial Team)