CriticalMalwareCVE-2026-113380
Critical Signal Vulnerability Could Keep Your Mic and Camera Live Even After Hang Up
Cyber Security News·Source published ·1 min read
What happened?
A critical vulnerability in Signal’s calling library could allow a malicious call participant to keep hearing audio after another user tries to hang up. The flaw, tracked as CVE-2026-113380, affects RingRTC versions before 2.72.0 and carries a CVSS severity score of 9.3. Video could also remain active, although the published description does not confirm that behavior. RingRTC powers Signal’s voice and video calling features across its mobile and desktop apps. The issue affects how calls shut down, not how Signal encrypts conversations.
Key details
- A critical flaw in RingRTC lets a malicious call participant keep audio active after the other user hangs up.
- The vulnerability is tracked as CVE-2026-113380 and affects RingRTC versions before 2.72.0 with a CVSS score of 9.3.
- RingRTC powers Signal's voice and video calling across mobile and desktop apps.
- The fix introduces a separate termination flag and five-second limits on shutdown waits to make call termination less dependent on the event queue.
- No known exploitation has been reported for this vulnerability.
- The flaw is distinct from previous Signal linked-device attacks and support impersonation campaigns.
Affected
- RingRTC versions before 2.72.0 used in Signal's calling features.
Fixes and mitigations
- Signal users should install available updates on every phone and computer they use.
- Developers building applications with RingRTC should use version 2.72.0 or later.
What to look for
- Check that call and microphone indicators have stopped before discussing private information nearby.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.