A critical vulnerability in RingRTC, the open source calling library used by Signal for voice and video calls, could allow a malicious caller to keep audio and video tracks active even after the user has hung up. The flaw, tracked as CVE-2026-113380 (CVSS 9.3), arises from how the call termination is handled in the library’s Finite State Machine (FSM). An attacker can flood the FSM’s event queue with junk events, causing the hangup to be deprioritised and remain in the queue. As a result, the victim’s microphone and potentially camera could stay active while the user believes the call has ended.
Security researchers highlighted that the hangup event was treated as a normal event added to the queue, with no rate limiting on peer-originated events and no special priority. A conceptual PoC published in a GitHub write‑up and subsequent reporting note that the remote peer could keep streams flowing from the target device. The defect was fixed in RingRTC version 2.72.0, released on 4 September. NIST has added the CVE to the National Vulnerability Database, and the issue was disclosed publicly this week.
Signal has mitigated the vulnerability by ensuring that termination requests cannot remain blocked in the FSM’s event queue and by implementing independent detection of hangup events. Users should update their Signal applications promptly; in the meantime, they should verify that the call indicator shows the call has truly ended before discarding the session.