Signal has addressed a critical security vulnerability within its RingRTC calling library that could allow a malicious participant to keep audio or video streams active after a call is terminated, based on information published by Cyber Insider.
The vulnerability, tracked as CVE-2026-113380, carries a CVSS score of 9.3 and affects RingRTC versions prior to 2.72.0. The flaw stems from how the library manages finite-state machines during call termination. By saturating the call queue with 256 entries, a remote peer can prevent the system from completing the shutdown process, effectively leaving the connection open. Signal developer jim-signal authored a corrective commit on Sept. 4 to ensure complete call termination. The patch introduces a separate termination flag and enforces a 5-second limit on shutdown waits, allowing cleanup to proceed even if specific operations fail. This update ensures that audio and video tracks are properly dismantled regardless of queue status. Users are encouraged to update their Signal applications to the latest version to mitigate this privacy risk. Developers utilizing the RingRTC library must upgrade to version 2.72.0 or later to incorporate these security improvements and prevent potential unauthorized monitoring of call participants.
Source: Cyber Insider
