Summary
- CVE-2026-113380 in Signal’s RingRTC library scores 9.3 (Critical) on the CVSS scale and affects every version prior to 2.72.0.
- An attacker on a call can saturate the library’s finite state machine event queue, causing hangup requests to go unprocessed — leaving audio and potentially video channels open without the victim’s knowledge.
- Attack complexity is rated low, and a conceptual proof of concept exists publicly on GitHub.
- The fix was shipped in RingRTC 2.72.0 approximately last month; Signal Desktop incorporated it around September, though precise rollout dates across all platforms remain unconfirmed.
- No confirmed in-the-wild exploitation has been recorded in CISA’s Known Exploited Vulnerabilities catalogue as of publication.
What the vulnerability does
Signal’s RingRTC library — the calling component built on top of the widely used WebRTC standard — contains a flaw that can prevent a voice or video call from ending when a participant hangs up. The issue, assigned CVE-2026-113380 and published by MITRE this week, is classified as CWE-754: improper checking for unusual or exceptional conditions.
The mechanics
RingRTC uses a finite state machine (FSM) to manage call events — connection, media negotiation, termination and so on. If a malicious participant deliberately floods the FSM’s event queue with requests, the queue becomes overwhelmed. A hangup request queued behind that flood can sit unprocessed indefinitely, meaning the call remains technically active even after both parties believe it has ended. Audio, and in some scenarios video, may continue to transmit without the affected user’s awareness.
How the fix works
Version 2.72.0 of RingRTC addresses the problem in two ways: the FSM can now detect termination requests independently of the event queue, rather than waiting for the queue to clear, and a timeout has been added to prevent stalled processing from blocking a hangup indefinitely. The patch was shipped roughly a month ago, with Signal Desktop confirmed to have incorporated it around September. The precise rollout dates for Android and iOS versions have not been confirmed by Signal, which had not responded to media enquiries at time of publication.
Proof of concept and exploitability
A conceptual proof of concept is available on GitHub, using a Python script to simulate how flooding an event queue blocks hangup processing. The CVE rates attack complexity as low. The attacker does need to be a participant in the call — there is no indication of a remote, unauthenticated exploitation path — but that is a realistic scenario in both targeted attacks and social engineering situations.
No confirmed exploitation, but the window existed
CISA’s Known Exploited Vulnerabilities catalogue does not currently list this vulnerability as having been observed in the wild. That said, the gap between patch availability and public disclosure means the vulnerability was exploitable against unpatched installations for a period before defenders were aware of it. The scope of that window across mobile and desktop platforms remains unclear given Signal has not confirmed platform-specific rollout dates.
Why it matters
Signal is widely used by executives, legal teams, board members, journalists and security practitioners precisely because of its encryption and privacy posture. A bug that silently keeps a microphone or camera active after an apparent hangup cuts directly against that expectation. For a CISO, the relevant risk is not abstract: sensitive conversations conducted immediately after a Signal call — in the belief the session has ended — could be exposed to a sophisticated adversary who engineered the call in the first place. The attack requires an insider position on the call, making it a plausible vector in targeted espionage, competitive intelligence theft, or insider threat scenarios. The low attack complexity rating amplifies concern: this does not require deep technical capability to attempt.
What to do now
- Update Signal on all platforms — Android, iOS, and desktop — to ensure RingRTC 2.72.0 or later is in use.
- Verify the installed Signal Desktop version incorporates the September update that includes RingRTC 2.72.0.
- Advise staff who use Signal for sensitive communications to confirm they are on the latest version before conducting calls.
- Until rollout dates across all platforms are confirmed by Signal, treat any unverified Signal installation as potentially vulnerable.
- Monitor CISA’s Known Exploited Vulnerabilities catalogue for any change in exploitation status for CVE-2026-113380.
