![\"Signal](\"https:\/\/www.newsbeep.com\/il\/wp-content\/uploads\/2026\/10\/signal-app-650.webp\" "\\"Signal\\"\/")
<\/p>\nA flaw in Signal\u2019s calling library could let the other person on a call keep receiving a user\u2019s audio, and possibly video, after that user hangs up.<\/p>\n
<\/p>\n
Tracked as CVE-2026-113380, the vulnerability affects RingRTC versions before 2.72.0. RingRTC is the open source library that powers voice and video calls in Signal\u2019s apps, built on WebRTC, the technology browsers use for live audio and video.<\/p>\n
The CVE record states<\/a> that \u201ca peer that saturates a call\u2019s FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.\u201d<\/p>\n MITRE published the CVE record on October 20, 2026, with a CVSS 4.0 score of 9.3. The score rates<\/a> the impact on the confidentiality and integrity of the vulnerable system as high, and the impact on its availability as none. The rating describes an attack carried out over the network, with low complexity and no privileges required.<\/p>\n CISA has not added the bug to its Known Exploited Vulnerabilities catalog, and the National Vulnerability Database lists it as awaiting analysis.<\/p>\n The issue was documented by a researcher who publishes notes on GitHub under the name Imahian. In their write-up<\/a>, a local hang-up is described as \u201cjust one more event placed at the back of the call\u2019s finite-state-machine event queue.\u201d<\/p>\n The other party on the call can add events to that same queue, and Imahian says RingRTC trusted the remote peer with it, with \u201cno rate limit on peer-originated events and no priority lane for hang-up.\u201d<\/p>\n The proof of concept, labeled conceptual, begins with an ordinary Signal call placed by the attacker, who then floods its event queue with junk. When the victim taps hang-up, the event gets stuck behind that backlog, and the call\u2019s audio, and possibly video, \u201ckeeps flowing to the attacker while the victim believes the call ended,\u201d Imahian wrote.<\/p>\n The bug reaches \u201cevery Signal client embedding an older RingRTC build,\u201d on Android, iOS and Desktop, until each client ships the fixed library, the write-up notes.<\/p>\n