A critical vulnerability in Signal’s calling stack could allow a caller to keep a recipient’s microphone (and potentially camera) active after the user believes the call has ended. The flaw, tracked as CVE-2026-113380 with a CVSS of 9.3, lies in RingRTC, the library Signal embeds for voice and video calls.
Versions of RingRTC earlier than 2.72.0 are affected, and so are Signal clients built with those vulnerable library versions: Signal for Android before 8.27.0, Signal for iOS before 8.30.0, and Signal Desktop before 8.29.0. The problem is not a break in end-to-end encryption, but rather how the call state is managed. A malicious participant can flood the call event queue with spurious events, causing the local hang-up action to be delayed or buried in the queue, preventing the call from being torn down promptly.
Technical researchers describe the issue as a flaw in the finite-state machine that governs calls. The responsible mechanism places events into a processing queue; without a dedicated rate limit or priority for hang-ups, attacker-supplied events can overwhelm the queue. A proof-of-concept in Python demonstrates the concept, modelling how prioritised events could ensure hang-ups terminate properly, versus floods that delay termination.
The fix is provided in RingRTC v2.72.0 and Signals users are advised to update to the latest Signal release for their platform. The advisory notes the vulnerability’s public disclosure does not imply active exploitation, but updating promptly is a prudent precaution for users handling sensitive discussions.