Signal fixed a critical flaw in RingRTC, the calling library it builds on WebRTC, but only now published details. Tracked as CVE-2026-113380 and scored 9.3, it lets the person on the other end of a call stop your hang-up from taking effect.
Every RingRTC build before 2.72.0 is affected. That version landed on September 4; the write-up and a conceptual proof of concept arrived on Tuesday.
A hung-up call that never tears down
RingRTC tracks calls through a finite state machine, a queue of events it works through in order. A hang-up is one more item in that queue rather than an override, there is no limit on how many events a peer may send, and the termination request carries no priority.
Flood the queue and the hang-up waits behind the noise. The call survives, and the audio track keeps sending. Video may stay open too, depending on the call. The caller appears hung up on their own handset, hears nothing unusual, and gets no warning that a microphone is still live.
The bug is classified as CWE-754, improper checking for exceptional conditions. A Python script in the GitHub report simulates the queue flood, and the CVE carries low attack complexity.
Update and verify
Signal’s fix lets the state machine detect a termination request on its own, outside the event stream. There is no KEV listing and no report of abuse. Update mobile and desktop clients, then glance at the call indicator after a call to confirm it actually closed. On iOS and Android, revoke the microphone permission for Signal when you do not expect to use voice.
