Signal's RingRTC flaw let a caller keep a "hung up" call alive
A peer could flood the call's event queue so the hang-up never ran, leaving audio and possibly video running after the user ended the call. Signal fixed it in RingRTC 2.72.0.
Signal has fixed a critical-severity flaw in RingRTC, the open source library behind its voice and video calls, that let a remote peer stop a call from ending, SecurityWeek reported.
The bug is tracked as CVE-2026-113380, with a CVSS score of 9.3. According to the advisory description, a peer that saturates a call's Finite State Machine queue can interfere with a local hang-up tearing the call down, along with its audio and perhaps its video track.
A researcher's write-up, quoted by SecurityWeek, lays out why: the hang-up was handled as an event placed in the FSM queue rather than a kill switch, peer-originated events had no rate limit, and the hang-up event carried no priority. Flood the queue, and the hang-up waits behind the noise.
The practical effect is that a target could believe the call ended while audio, and possibly camera, kept flowing from their device.
Signal resolved the issue in RingRTC version 2.72.0, released on September 4, by making termination requests detectable independently so they don't stay stuck in the queue. Details and a conceptual proof of concept were published later, and NIST added the CVE to the NVD database the same day, per the report.
Defenders should update Signal. Users who can't update right away should check the call indicator to confirm a call actually ended.
CVE references
Sources
- Signal Vulnerability Lets Malicious Callers Block Hang-UpsPrimarywww.securityweek.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning
