Cybersecurity

Signal Resolves Critical RingRTC Vulnerability That Blocked Hang-Ups

A critical-severity security flaw in Signal's open source calling library allowed malicious remote callers to prevent calls from terminating, keeping audio and video tracks active after the user attempted to hang up.

Radwan AbdulhadiEditor and technology writer

Published: October 23, 2026 · Updated: October 23, 2026 · 3 min read

Signal Resolves Critical RingRTC Vulnerability That Blocked Hang-Ups — Image: SecurityWeek

Critical Vulnerability Discovered in RingRTC

Signal has successfully resolved a critical-severity vulnerability affecting RingRTC, the open source library utilized by the platform for voice and video calls. Tracked as CVE-2026-113380 with a CVSS score of 9.3, the security defect involves how the calling library processes incoming call events, potentially leaving audio and video tracks enabled even after a user believes they have successfully ended a call.

How the FSM Event Queue Exploitation Works

The vulnerability stems from the architecture of the call's Finite State Machine (FSM) event queue. A remote peer could exploit the system by flooding the FSM event queue with junk data, preventing normal call termination procedures. According to a detailed technical breakdown shared in a GitHub [write-up](https://github.com/Imahian/Notes/tree/main/docs/CVEs/CVE-2026-113380) by a researcher, the hang-up mechanism failed to act as an immediate kill switch. Instead, it was treated merely as an event added to the queue without any rate limiting or priority status for peer-originated events.

The researcher noted that flooding the queue with junk causes the hang-up command to wait behind attacker noise indefinitely, meaning the microphone and potentially the camera are never properly torn down. Consequently, an attacker could maintain audio and video streams from a target device while the victim remains entirely unaware, assuming the communication session has concluded.

Patch Release and Public Disclosure

The security defect was addressed by the development team in RingRTC [version 2.72.0](https://github.com/signalapp/ringrtc/blob/a1d2ffed1de6ac5b22458a3dced8374513cc44f8/CHANGELOG.md), which was officially released on September 4. However, comprehensive details regarding the flaw, alongside a conceptual proof-of-concept (PoC), were publicly published later. Following the disclosure, NIST formally added the CVE identifier to the National Vulnerability Database.

Mitigation and Recommended User Action

To resolve the issue permanently, Signal implemented architectural updates ensuring that call termination requests can no longer remain blocked within the FSM's event queue and are instead detected independently. Security experts strongly urge all users to update their Signal applications as soon as possible to secure their devices against potential exploitation.

For users who have not yet updated their software, security guidance advises closely checking active call indicators to verify whether a voice or video call has indeed fully terminated before putting the device down or discussing sensitive information.