Signal flaw could expose audio and video even after users hang up

A newly disclosed flaw in RingRTC, the open-source calling library behind Signal's voice and video calls, could let a malicious caller keep receiving a victim's audio and video even after the victim thinks they've hung up. Tracked as CVE-2026-113380 and affecting RingRTC versions prior to 2.72.0, the issue stems from the library's call event queue accepting unlimited events from the remote peer without rate limiting or priority handling for hang-up commands. A researcher known as Imahian published a conceptual proof of concept showing that an attacker can flood this queue during a call, delaying the local hang-up event and allowing the call's media stream to keep flowing to the attacker while the victim believes the session has ended. MITRE assigned a CVSS 4.0 score of 9.3, reflecting high confidentiality and integrity impact with no privileges required, though the bug has not been added to CISA's Known Exploited Vulnerabilities list and there are no confirmed real-world attacks yet. The flaw affects every Signal client (Android, iOS, Desktop) bundling an outdated RingRTC build, and users are urged to update as the library has already been patched in version 2.72.0.