Signal RingRTC bug CVE-2026-113380 can leave mic and camera active after a call hangup
A vulnerability in Signal's open-source RingRTC calling library, tracked as CVE-2026-113380 (CVSS 9.3), can stop a call from terminating properly. This can leave audio and possibly video channels open after a user hangs up. MITRE published the CVE on Tuesday. The affected versions are every RingRTC release before 2.72.0, and the fix shipped last month without being disclosed until now. CISA's KEV catalog does not list the flaw, and the article reports no in-the-wild exploitation. Attack complexity is low.
Entenda a falha
A vulnerabilidade
CVE-2026-113380 (CVSS 9.3, CWE-754) is a flaw in RingRTC, Signal's open-source calling library built on WebRTC, used by Signal Desktop, Android and iOS. Its finite state machine (FSM) event queue, which manages call events, can be saturated with requests by another call participant. The queue then fails to process the hangup, so the call does not terminate properly. A malicious peer can make the other party think the call ended while audio and possibly video stay open. Attack complexity is low. The articles do not describe any authentication requirement beyond being a call participant. Every RingRTC release before 2.72.0 is affected. The fix in 2.72.0 lets the FSM detect termination requests independently of the queue and adds a timeout so stalled processing cannot block a hangup indefinitely.
Como foi descoberta
The articles do not say who found the flaw or how it was reported. MITRE published the CVE on Tuesday, with details in a report on GitHub that includes a conceptual proof of concept using a Python script. Signal shipped the fix in RingRTC 2.72.0 last month, but the vulnerability was only made public now. The Register learned of the fix by comparing 2.72.0 with the previous version. Signal Desktop's release history shows 2.72.0 was included in September, while Android and iOS rollout dates are unclear. Signal had not responded to The Register's inquiry. CISA's KEV catalog does not list the flaw and no in-the-wild exploitation is reported.
Explicação gerada por IA a partir da matéria e dos artigos, em 21/10/2026 16:17.
Detalhes técnicos
RingRTC is Signal's calling library built on WebRTC. A call participant can saturate the library's finite state machine (FSM) event queue with requests. The queue then fails to process the hangup request, effectively a denial of service against call-termination handling. The flaw is classified as CWE-754 (improper checking for unusual or exceptional conditions). A conceptual proof of concept in the GitHub report uses a Python script to simulate flooding the event queue. A malicious peer could exploit this so the other party believes the call has ended while one or both of their audio and video channels remain open.
The fix in RingRTC 2.72.0 lets the FSM detect termination requests independently of the event queue. It also adds a timeout so stalled processing cannot block a hangup indefinitely. Signal Desktop's release history shows 2.72.0 was incorporated in September. The rollout dates for Android and iOS are unclear, and Signal had not responded to The Register's inquiry.
Remediação
- Update Signal on mobile and desktop to the latest versions, which include RingRTC 2.72.0 or later.
Linha do tempo
-
Signal RingRTC bug CVE-2026-113380 can leave mic and camera active after a call hangup
ler a análise desta fonte ocultar
A vulnerability in Signal's open-source RingRTC calling library, tracked as CVE-2026-113380 (CVSS 9.3), can stop a call from terminating properly. This can leave audio and possibly video channels open after a user hangs up. MITRE published the CVE on Tuesday. The affected versions are every RingRTC release before 2.72.0, and the fix shipped last month without being disclosed until now. CISA's KEV catalog does not list the flaw, and the article reports no in-the-wild exploitation. Attack complexity is low.
Technical Details
RingRTC is Signal's calling library built on WebRTC. A call participant can saturate the library's finite state machine (FSM) event queue with requests. The queue then fails to process the hangup request, effectively a denial of service against call-termination handling. The flaw is classified as CWE-754 (improper checking for unusual or exceptional conditions). A conceptual proof of concept in the GitHub report uses a Python script to simulate flooding the event queue. A malicious peer could exploit this so the other party believes the call has ended while one or both of their audio and video channels remain open.
The fix in RingRTC 2.72.0 lets the FSM detect termination requests independently of the event queue. It also adds a timeout so stalled processing cannot block a hangup indefinitely. Signal Desktop's release history shows 2.72.0 was incorporated in September. The rollout dates for Android and iOS are unclear, and Signal had not responded to The Register's inquiry.
Remediation
- Update Signal on mobile and desktop to the latest versions, which include RingRTC 2.72.0 or later.