Signal Vulnerability Could Keep Microphone Active Even After Users Hang Up

A critical vulnerability in Signal’s RingRTC calling library could let a malicious call participant keep receiving audio after another user tries to hang up.

This vulnerability, tracked as CVE-2026-113380, affects versions of RingRTC before 2.72.0 and carries a CVSS v4.0 score of 9.3. While video tracks could also remain active, the official vulnerability description does not qualify this possibility.

MITRE published details about this vulnerability on October 20, 2026, classifying it as CWE-754: Improper Check for Unusual or Exceptional Conditions.

RingRTC provides calling components for both Signal’s mobile and desktop applications, making reliable call termination a significant privacy concern.

Signal Vulnerability

The vulnerability involves finite-state machines (FSMs) that coordinate changes in call and connection states. These FSMs have bounded event queues that can accommodate 256 entries. A remote participant can saturate a call’s queue, disrupting the local shutdown process when the other participant presses the hang-up button.

Patch analysis suggests that the prior termination sequence could stop prematurely if an operation failed. A full queue could prevent submission of a termination event, while other failures, such as unsuccessful application notifications, could interrupt subsequent cleanup. As a result, the underlying connection and media tracks might not be completely dismantled.

This issue is more specific than an endlessly growing backlog: the queues are bounded, and exceptional conditions can hinder shutdown completion.

According to Imahian, the attack scenario involves a malicious participant in a call, not an unrelated observer passively intercepting communications.

Successful exploitation of this vulnerability could expose conversations that occur after the victim believes the communication has ended. However, the technical description available does not specify what affected clients display or how video behaves during an unsuccessful teardown.

The corrective change for this issue was authored by Signal developer “jim-signal” on September 4. Released in RingRTC version 2.72.0, the fix introduces a separate termination flag that state machines check independently of queued events.

The patch also imposes five-second limits on FSM shutdown waits and allows cleanup to proceed even when termination operations fail. Regression tests simulate saturated queues and notification failures, ensuring that a hang-up closes the simulated peer connection, disables outgoing audio, and clears its RTP packet sink.

Users should install the latest Signal updates. Developers embedding RingRTC should upgrade to version 2.72.0 or later. The library version defines the range of affected versions; the cited reporting did not confirm specific impacted application releases, so avoid making platform-wide assumptions when assessing individual client exposure.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.