Signal Fixes Critical RingRTC Flaw That Could Keep Calls Active After Hang-Up
Summary
A critical RingRTC flaw could let a remote caller keep a victim’s audio and video tracks active after hang-up by flooding the call event queue. Signal fixed it in RingRTC 2.72.0 and advises users to update.
Key points
- CVE-2026-113380, rated CVSS 9.3, affects RingRTC, the open-source library Signal uses for voice and video calls.
- A remote peer could flood the call’s finite state machine event queue, delaying the hang-up event and preventing call termination.
- The flaw could leave audio and video tracks flowing from a target device after the user believed the call had ended.
- Signal fixed the issue in RingRTC 2.72.0, released September 4, by handling call termination requests independently of the event queue.
- Details and a conceptual proof of concept were published Tuesday; NIST added the CVE to the NVD that day.
- Signal users are advised to update their applications or check the call indicator to confirm a call has ended.
Article Details
- Vulnerability Types
- Finite State Machine event-queue denial of service affecting call termination
- Severity
- Critical (CVSS 9.3)
- Affected Versions
- RingRTC versions before 2.72.0
- Exploitation Status
- unknown
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Check the call indicator to make sure the call has ended.
CVE
Vendors
Products
RingRTCThe security defect is tracked as CVE-2026-113380 (CVSS score of 9.3) and impacts RingRTC, the open source library Signal uses for voice and video calls, which is based on WebRTC.SignalSignal has resolved a critical-severity vulnerability that could allow a malicious caller to keep audio and video tracks enabled even after the user hung up.