A critical flaw in RingRTC, the library behind Signal’s voice and video calls, could let the other person on a call stop your hang-up from taking effect, so your microphone and possibly your camera stay live. Signal fixed it in September, but has not said which app versions carry the fix, so the safe assumption is that any Signal client that has not been updated recently is exposed.
What happened
On 20 October 2026 MITRE published CVE-2026-113380, which covers every version of Signal’s open-source RingRTC calling library before 2.72.0. The record carries a CVSS 4.0 base score of 9.3, which puts it in the critical band. It is filed under CWE-754, the weakness class for software that fails to check for unusual or exceptional conditions.
The record says the problem is this: a peer that saturates a call’s state machine queue can interfere with a local hang-up tearing down the call, along with its audio and perhaps also its video track. Put simply, you press the red button, believe the call is over, and the other party may still hear you.
The fix itself is not new: a Signal developer committed it on 4 September and it shipped in RingRTC 2.72.0. What changed this week is disclosure, with a CVE, a severity score and a researcher’s write-up including a conceptual proof of concept. The Register and CyberInsider both asked Signal about affected client versions and when the fix reached its apps. Neither had received a reply when they published.
The technical picture
RingRTC sits on top of WebRTC and adds the calling logic that Signal’s Android, iOS and desktop apps use. Each call, and each connection underneath it, is driven by a finite state machine (FSM) that works through events in order from a bounded queue. According to CyberInsider’s analysis of the patch, each queue holds 256 entries.
The weakness lies in how a hang-up was handled. Before the fix, ending a call was treated as just another event, joining the back of the same queue as everything else. According to the researcher’s write-up, nothing stopped the remote side from generating events, and nothing let the hang-up jump the queue. If the queue was full, the termination event could fail to be submitted at all. The old teardown could also bail out early when any single step failed, leaving later clean-up undone.
The 2.72.0 change takes a belt-and-braces approach. Both the call and connection state machines now watch a dedicated termination marker that bypasses the queue entirely. Waits for an FSM to shut down are capped at five seconds, and clean-up continues even when one step errors.
Some important things are still unknown. The CVE scoring treats the attack as needing nothing more than a call the victim takes part in, with low complexity and no special privileges. However, the published research is described as a synthetic, offline simulation rather than a working attack on real clients. The CVE record says video “perhaps” stays live but gives no detail, and nobody has said what an affected app would actually show on screen. CISA’s enrichment of the record lists no known exploitation, and the flaw is not in the Known Exploited Vulnerabilities catalogue.
Why it matters for UK organisations
Signal is not a corporate tool like Teams or Zoom, but it is common in UK professional life. Journalists, lawyers, people working in politics, executives and security teams use it, often on personal phones, because they expect privacy. A bug that undermines the most basic assumption of any call, that hanging up ends it, cuts straight against that trust.
The worrying scenario is not mass exploitation. It is targeted eavesdropping. Someone who can get a target onto a call, a source, a client or a counterparty, could in principle keep listening after the target thinks the conversation is over, which is often exactly when people relax and talk most freely. For anyone handling commercially sensitive or legally privileged material, that is a real confidentiality risk, however unlikely.
The version uncertainty is the operational headache. RingRTC is a library, not an app, so the CVE record lists a library version that most users will never see. The Register reports that Signal Desktop’s release history suggests 2.72.0 arrived in September, but nobody has confirmed rollout dates for Android or iOS. Until Signal says otherwise, organisations cannot point to a specific app version and declare themselves safe. They can only make sure clients are current.
Expert view
This is a textbook example of a control message being starved by data. When we test real-time systems, one of the first questions is whether high-priority signals such as “stop”, “disconnect” or “shut down” share a path with traffic an adversary can influence. If they do, the system’s safety depends on that path never filling up, and an attacker’s job is to fill it. The fix Signal chose, a flag outside the queue plus timeouts, is the right pattern and one I would recommend to any team building calling or messaging features.
I would also be careful not to overstate the danger. A 9.3 score looks alarming next to the remote code execution bugs we have seen this month, but this flaw does not hand anyone control of a device. It extends a session the victim already agreed to join. The impact is serious for the specific people who might be targeted, and minor for almost everyone else, provided they update.
Fixing quietly and disclosing later protects users who update automatically, but leaves defenders guessing. Client version numbers from Signal would turn a vague “update everything” into something teams can verify.
In my experience, any app that holds the microphone and camera deserves the same patching discipline as a browser. Strong encryption does nothing to protect you from a bug in how a call ends.
What to do now
- Update Signal everywhere. Push the latest Signal release to managed Android, iOS and desktop devices, and ask staff who use it on personal phones for work to update from the official app store today. This falls under the Cyber Essentials security update management control, which expects high and critical fixes to be applied within 14 days.
- Check for automatic updates. Confirm MDM policy is not blocking app store auto-updates, and find desktop installs outside normal software management.
- Brief high-risk users. Executives, legal, communications and security staff should check that the operating system’s microphone and camera indicators go off after every call.
- Developers using RingRTC: move to 2.72.0 or later, and review your own real-time code for control events that queue behind traffic the remote side controls.
- Watch for a Signal statement. If Signal publishes client version numbers, record them in your asset inventory and check managed devices against them.
Bottom line
CVE-2026-113380 is not a device takeover, but it breaks a promise every calling app makes: when you hang up, you stop being heard. The fix has been available for weeks, no attacks have been reported, and the practical answer is simple. Get every Signal client updated now, because until Signal names the affected app versions, staying current is the only assurance anyone has.
