Signal fixes critical flaw that could keep audio active after hangup

Signal has fixed a vulnerability in its RingRTC calling library that could let a malicious call participant interfere with hangup, potentially leaving audio, and possibly video, active after the other person tries to end the call.

Tracked as CVE-2026-113380, the issue affects RingRTC versions before 2.72.0. The flaw has been assigned a critical CVSS v4.0 severity score of 9.3.

Signal developer ‘jim-signal’ authored the corrective commit on September 4, describing it as a change to ensure complete call termination in exceptional circumstances. The fix was included in RingRTC 2.72.0, whose changelog lists the same improvement.

RingRTC is the open-source library behind Signal’s voice and video calling functionality, providing calling components for its mobile and desktop applications. The vulnerability concerns how those components end a call, creating a potential privacy risk when a participant expects communication to stop.

CyberInsider contacted Signal to ask which client versions, if any, are impacted, but had not received a response by publication time.

How hangup could fail

The problem involves the finite-state machines (FSMs) that manage calls and their underlying connections. These components process events through bounded queues, each with a capacity of 256 entries.

According to the vulnerability description, a remote peer that saturates a call’s FSM queue can interfere with a local hangup completing the shutdown process. In practical terms, pressing the end-call button could fail to fully dismantle the underlying call and its media tracks.

Analysis of the supplied patch shows that the previous termination sequence could return early when an operation failed, preventing later cleanup steps from running. A full event queue could prevent the system from submitting a termination event, and other errors, such as failing to notify the application that a call had ended, could also interrupt teardown.

The privacy concern is that audio could remain active beyond the intended end of a call. The advisory also notes possible video involvement, although the supplied material does not specify the video behavior or what affected clients would display.

Enforcing shutdown

The patch introduces a separate termination flag that the call and connection state machines check independently of queued termination events. It also adds five-second limits to waits for FSM shutdown and allows cleanup to proceed when those waits or other termination operations, fail.

New regression tests simulate saturated call and connection queues, along with application notification failures. They check that hangup closes the simulated peer connection, turns off outgoing audio, and clears its RTP packet sink.

Signal users should install available application updates and make sure they are running the latest available version for their platform. Developers integrating RingRTC should use version 2.72.0 or later.