A researcher has published full details and a proof-of-concept for CVE-2026-113380, a critical vulnerability in Signal’s RingRTC library. The flaw allows a remote peer to flood a call’s event queue so that hanging up does not terminate the call, potentially keeping the microphone and possibly the camera streaming to the caller. RingRTC versions prior to 2.72.0 are affected, and the vulnerability is rated CVSS 9.3 (Critical, CVSSv4).
Signal has released a fix in 2.72.0 that terminates calls by introducing a termination flag that bypasses the queue and by capping teardown waits at five seconds. The advisory notes an EPSS of 0.3% over the past 30 days and recommends updating to 2.72.0 immediately.
Exploitation status remains unconfirmed in the wild, and the issue is not listed in CISA KEV. The public write-up, including a PoC, describes how RingRTC handles each call with a finite-state machine and an event queue, where a hang-up is merely another event at the back of the queue. A remote peer can bypass normal termination by flooding the queue, allowing audio to continue despite an attempted hang-up.
The PoC provided models the flaw as an offline queue simulation rather than a live exploit, and a short video explaining the hang-up flaw has been published. Users and developers are advised to update to 2.72.0 and verify that a call terminates promptly after hanging up; developers should consider giving control events a higher priority to prevent similar delays.