Signal has recently patched a severe vulnerability that posed significant privacy risks by allowing unauthorized callers to maintain active audio and video streams even after the recipient believed they had ended the call. This bug was identified as CVE-2026-113380, scoring 9.3 on the CVSS scale, indicating its critical nature.
Understanding the Vulnerability
The flaw was located within RingRTC, the open-source framework employed by Signal for its voice and video functionalities, which relies on WebRTC technology. This issue arose when a remote attacker could manipulate the call’s Finite State Machine (FSM) by overwhelming its event queue with unnecessary data. As a result, legitimate hang-up signals from users were delayed indefinitely.
The root of the problem was that hang-up actions were treated merely as regular events within the FSM queue rather than immediate termination commands. The absence of rate limits for events originating from peers further exacerbated the situation, allowing attackers to effectively block call termination.
Implications and Exploitation
This vulnerability allowed attackers to continue streaming audio and video from the victim’s device without their knowledge. A GitHub report detailed how an attacker could exploit this flaw by ensuring the hang-up request remained perpetually queued behind a barrage of other events, thus preventing the call’s actual termination.
Although the details of this security issue and a proof-of-concept were disclosed publicly only recently, the vulnerability was addressed in RingRTC version 2.72.0, released on September 4. The National Institute of Standards and Technology (NIST) has since added this CVE to its National Vulnerability Database.
Recommendations and Future Outlook
Signal has implemented a fix to ensure that call termination requests are not obstructed within the FSM’s event queue, allowing them to be processed independently and promptly. Users are strongly advised to update their Signal applications immediately to safeguard against potential exploitation. Additionally, verifying the call end indicator can offer extra assurance of call termination.
This incident underscores the importance of regular software updates and vigilance in cybersecurity practices. Users and organizations should remain alert to security advisories to protect themselves from such vulnerabilities in the future.
