Signal RingRTC bug may leave audio and video active after hangup

Vulnerability details

A flaw in the RingRTC library used by Signal can prevent a call from fully terminating. The issue exists in every version before 2.72.0 and was assigned CVE-2026-113380 with a CVSS score of 9.3 by MITRE.

The problem occurs when a peer saturates the call's finite state machine queue, which interferes with the local hangup process and may keep audio, and possibly video, tracks alive.

Impact on users

After a user ends a call, the microphone or camera may stay active. The advisory does not say what, if anything, the app shows on screen in that situation, and the duration of any continued transmission is unspecified. There is no evidence that the vulnerability has been exploited in the wild.

Cybernews notes that no passwords can be stolen and no accounts compromised through this bug; the risk is limited to unwanted listening or viewing after a call appears to have ended.

Mitigation and updates

Signal released an update for RingRTC last month that adds a timeout and lets the call state machine detect termination requests independently of the event queue. The release notes do not make clear exactly when the fixed version reached Android, iOS and desktop builds.

Users should install the latest available Signal version on each device. Keeping the app updated remains the primary protection against this issue.

Sources: Cybernews · The Register