A fix has been released for a critical vulnerability in Signal’s calling software that could allow another participant to continue hearing audio after a user hangs up, potentially exposing private conversations.
According to Malwarebytes, the vulnerability, tracked as CVE-2026-113380, carries a critical severity rating of 9.3 out of 10. It affects versions of RingRTC earlier than 2.72.0, the open-source library that powers Signal’s voice and video calling features.
Issue with Call Shutdown
The flaw affects how RingRTC handles requests to end a call. A malicious participant could overwhelm an internal queue responsible for processing calling events, potentially interfering with the steps needed to disconnect the other person.
If successfully exploited, the vulnerability could allow microphone audio to continue transmitting after someone believes the call has ended. Continued video transmission may also be possible, although the available disclosures do not establish how long either connection could remain active.
The issue involves call termination rather than Signal’s encryption. It does not, by itself, expose stored messages, passwords or account credentials.
Update Now
Signal’s developers have updated RingRTC’s call termination handling to prevent shutdown failures when internal processing encounters problems. The correction is included in RingRTC 2.72.0, and there are no known reports of the vulnerability being exploited in real-world attacks.
Users should install available Signal updates. However, Malwarebytes noted that the first Signal app versions incorporating the fix had not yet been publicly confirmed.
Leave a Reply