Signal Call Vulnerability Details and PoC Published, Showing Hang-Up Can Fail to End Calls
Do Son 
TL;DR
A researcher has published full details and a proof-of-concept for CVE-2026-113380, a critical Signal call vulnerability in the RingRTC library. A peer can flood a call’s event queue so the victim’s hang-up never takes effect. RingRTC 2.72.0 fixes the flaw, which scores CVSS 9.3.
- CVE: CVE-2026-113380
- CVSS: 9.3 (Critical · CVSSv4)
- Product: Signal RingRTC
- Affected: < 2.72.0
- Status: No confirmed exploitation yet
- Patched in: 2.72.0
- EPSS: 0.3% (30-day)
- Action: Update to 2.72.0 now
Why It Matters
RingRTC powers voice and video calls in Signal on Android, iOS and Desktop. Users trust that hanging up ends a call. Instead, this bug can keep the microphone, and possibly the camera, streaming to the caller. According to the write-up, an attacker only needs to start a normal call to trigger this Signal call vulnerability.
Details and PoC are public
Researcher Ahian released a technical write-up and PoC for CVE-2026-113380. Its poc.py script models the flaw “safely” as a “purely synthetic, offline” queue simulation, not a live exploit. The researcher also posted a short video explaining the Signal hang-up flaw on October 19.
How the Attack Works
RingRTC handles each call with a finite-state machine and an event queue. However, a local hang-up “is not a kill switch,” the write-up explains. It is “just one more event placed at the back” of that queue.
The remote peer faces no rate limit, and hang-up gets no priority. So if a peer fills the queue with junk, the hang-up waits behind it. Meanwhile, the call’s audio keeps flowing.
Exploitation status
No source confirms exploitation of this Signal call vulnerability in the wild. It is not in CISA’s KEV catalog.
Affected Versions
All RingRTC versions before 2.72.0 are affected. That includes every Signal client that still bundles an older build.
Patch and Mitigation Steps
Signal’s RingRTC fix to ensure calls terminate completely adds a termination flag that bypasses the queue. It also caps teardown waits at five seconds.
- Update Signal from your app store.
- Check the call indicator disappears after hanging up.
- Developers should give control events a priority lane.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
