Signal RingRTC bug CVE-2026-113380 can leave call audio active after hangup
A vulnerability in Signal's open-source RingRTC calling library, tracked as CVE-2026-113380 (CVSS v4.0 9.3), can stop a call from terminating properly. This can leave audio, and possibly video, channels open after a user hangs up. MITRE published the CVE on October 20, 2026, classified as CWE-754, and NIST added it to the NVD on Tuesday (…