Signal RingRTC Flaw Can Keep Your Mic Live
When Hang Up Does Not Hang Up
In Signal, the hang-up button could fail even when a user tried to end a call. A critical bug in the RingRTC library let another call participant block the disconnection. As a result, the microphone could stay active after the user tried to hang up. Under some conditions, the video stream could survive too.
About CVE-2026-113380
The Signal RingRTC vulnerability, CVE-2026-113380, went public on October 20, 2026. It scores 9.3 out of 10 on CVSS 4.0, which makes it critical. It affects every RingRTC version before 2.72.0.
RingRTC handles voice and video calls in Signal. It runs on top of WebRTC, the technology that carries audio and video over the internet.
How the Bug Works
The cause lies in the event queue that RingRTC uses to manage the state of a call. An attacker already on the call could flood the queue with many requests. That slowed the handling of the command to end the call.
With the queue overloaded, the hang-up signal no longer passed through in time. The program might then fail to close the connection and its audio channels.
What an Attacker Needs
Knowing a phone number or sending a message is not enough. The attacker must sit at the other end of an active call and put load on the event handling. If the attack works, the other party may believe the conversation is over while audio keeps flowing. The bug description lists the video channel as a possible outcome, not a proven one.
The Fix in RingRTC 2.72.0
Signal’s developers fixed the call-ending mechanism in RingRTC 2.72.0. The disconnect request now counts separately from the overloaded event queue. The code also caps the wait for the process to stop at five seconds, so a stuck handler cannot hold the connection forever. The changes touch several components of the library.
Patch Timeline and Open Questions
The fixed RingRTC shipped in September, about a month before the public disclosure. According to the Signal Desktop history, the new library reached the desktop app the same month.
The exact dates for the fix in every Signal version on Android and iOS remain unclear. Therefore, no one can yet name the vulnerable Signal version for each platform with confidence.
Risk in Perspective
A proof-of-concept in Python on GitHub shows how a flooded queue can delay the end of a call. It explains the mechanism of the failure. It does not prove successful eavesdropping on real users.
No public reports of confirmed attacks with CVE-2026-113380 exist so far. The flaw also does not appear in CISA’s catalog of actively exploited vulnerabilities.
What Was Not Affected
The bug did not touch the end-to-end encryption algorithms. It did not give access to message history or passwords. Signal users should install the available updates on both phones and computers.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
