Signal flaw could expose audio and video even after users hang up

A flaw in Signal’s calling library could let the other person on a call keep receiving a user’s audio, and possibly video, after that user hangs up.

Tracked as CVE-2026-113380, the vulnerability affects RingRTC versions before 2.72.0. RingRTC is the open source library that powers voice and video calls in Signal’s apps, built on WebRTC, the technology browsers use for live audio and video.

The CVE record states that “a peer that saturates a call’s FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.”

MITRE published the CVE record on October 20, 2026, with a CVSS 4.0 score of 9.3. The score rates the impact on the confidentiality and integrity of the vulnerable system as high, and the impact on its availability as none. The rating describes an attack carried out over the network, with low complexity and no privileges required.

CISA has not added the bug to its Known Exploited Vulnerabilities catalog, and the National Vulnerability Database lists it as awaiting analysis.

The issue was documented by a researcher who publishes notes on GitHub under the name Imahian. In their write-up, a local hang-up is described as “just one more event placed at the back of the call’s finite-state-machine event queue.”

The other party on the call can add events to that same queue, and Imahian says RingRTC trusted the remote peer with it, with “no rate limit on peer-originated events and no priority lane for hang-up.”

The proof of concept, labeled conceptual, begins with an ordinary Signal call placed by the attacker, who then floods its event queue with junk. When the victim taps hang-up, the event gets stuck behind that backlog, and the call’s audio, and possibly video, “keeps flowing to the attacker while the victim believes the call ended,” Imahian wrote.

The bug reaches “every Signal client embedding an older RingRTC build,” on Android, iOS and Desktop, until each client ships the fixed library, the write-up notes.

The flaw is fixed in RingRTC 2.72.0, and the CVE record links to the corresponding commit in the library’s GitHub repository.

So far, there are no known reports of exploitation in the wild, and details on the attack are thin beyond the conceptual proof of concept. Signal users should keep the app updated on every device they use for calls.