Signal Vulnerability Lets Malicious Callers Block Hang-Ups

Signal has fixed a severe flaw in RingRTC, the WebRTC-based library powering its voice and video calls, which let a malicious caller keep a victim's microphone and camera streaming even after the call appeared to have ended. Tracked as CVE-2026-113380 with a CVSS score of 9.3, the bug stemmed from treating call termination as just another entry in the call's internal event queue rather than an immediate kill command, with no rate-limiting or priority given to hang-up requests. An attacker could therefore flood that queue with bogus events, effectively delaying the real hang-up indefinitely while audio and video kept flowing from the target's device. Signal addressed the problem in RingRTC 2.72.0, released September 4, by making call-termination requests independent of the event queue; technical details and a proof-of-concept surfaced publicly this week, so users are urged to update promptly and double-check their call status indicator in the meantime.