Signal Fixes RingRTC Flaw That Could Keep Microphone and Camera Active After Hangup

Signal patched CVE-2026-113380, a critical vulnerability in its RingRTC calling library that could allow a malicious call participant to keep audio or video streams active after another participant believes they have hung up. The flaw, reported with a CVSS score of 9.3, affects RingRTC versions before 2.72.0. A remote peer could saturate a 256-entry event queue, preventing the call-termination state machine from completing shutdown and potentially enabling unauthorized monitoring.

RingRTC 2.72.0 addresses the flaw by handling termination requests independently of the event queue through a separate termination flag and imposing a five-second shutdown-wait limit. A conceptual proof of concept is publicly available, but the reporting provides no evidence of exploitation in the wild. Users should update Signal on mobile and desktop, while developers using RingRTC should upgrade to version 2.72.0 or later; the precise rollout dates of the fix across Signal platforms remain unclear.