Signal app vulnerability exposed user audio, video

Key Takeaways

• A critical vulnerability (CVE-2026-113380) in Signal’s RingRTC library could allow a malicious caller to continue receiving audio and potentially video after a user attempts to end a call.
• The flaw impacts RingRTC versions prior to 2.72.0, affecting Signal’s mobile and desktop applications.
• The vulnerability stems from an overloaded internal event queue, preventing proper call termination.
• The issue has a CVSS severity score of 9.3, indicating high severity.
• A fix is available in RingRTC 2.72.0, and users are urged to update their Signal applications immediately.

A severe vulnerability within Signal’s core calling infrastructure, specifically its RingRTC library, could have exposed users to continued audio (and potentially video) transmission even after they believed a call had been terminated. This critical flaw, identified as CVE-2026-113380, carried a CVSS severity score of 9.3, underscoring its significant risk.

The issue affects RingRTC versions preceding 2.72.0, which underpins Signal’s voice and video capabilities across its various platforms, including mobile and desktop applications. The core problem lies not with Signal’s robust encryption, but with the mechanism responsible for gracefully shutting down an active connection. A secure channel, once established, could inadvertently remain open and transmit private audio if the software failed to close it correctly after a user pressed the end-call button, as detailed in a Malwarebytes blog post.

How the Vulnerability Works

The technical root of CVE-2026-113380 is an internal event queue utilized by RingRTC’s finite-state machine (FSM). This FSM is crucial for managing the various states of a call and processing commands that dictate its operation. A malicious participant in a call could intentionally flood this event queue, disrupting the critical sequence of steps required to properly terminate the call. This interference could prevent the call from fully disconnecting, leaving the audio channel open.

According to Imahian’s GitHub vulnerability description, this saturation of the event queue could effectively block a local hang-up command from completing its task, potentially allowing the remote participant to continue listening even after the local user perceives the conversation has ended. While video could also remain active, the published descriptions do not definitively confirm this behavior in all scenarios.

It is crucial to note that this attack scenario necessitates an active, malicious participant within the call itself. The vulnerability is not described as a method for an external actor to remotely activate a Signal user’s microphone without their involvement in a call. Furthermore, current reporting does not provide conclusive details on what affected users would visually observe on their screens or the precise duration for which unwanted transmissions might persist.

A Python demonstration exists that illustrates how queued events can impede hang-up processing. However, this simulation operates offline and does not constitute a real-world attack on Signal or proof of in-the-wild exploitation.

The Fix and What It Means

The resolution for this vulnerability, implemented in RingRTC 2.72.0, significantly reduces the call termination process’s reliance on the potentially overloaded event queue. This updated version introduces a dedicated termination flag that both call and connection state machines can independently check. Additionally, it incorporates five-second timeouts for shutdown waits, enabling cleanup procedures to continue even if individual steps encounter failures.

Analysis of the patch indicates that tests covered scenarios involving full queues and failed application notifications. These tests confirm that the hang-up command effectively closes the simulated connection, disables outgoing audio, and clears the component responsible for handling outgoing media packets. The update primarily strengthens the shutdown behavior, rather than altering or replacing Signal’s fundamental encryption mechanisms.

While the specific version of the Signal application that incorporates RingRTC 2.72.0 across all platforms has not been precisely detailed in reviewed reports, the underlying library version is the key indicator of the fix.

This incident is distinct from previous Signal-related security concerns, such as linked-device attacks targeting account access or support impersonation campaigns designed to trick users into divulging registration information. Those incidents involved different attack vectors and methodologies, unrelated to this call-shutdown failure.

As of the reviewed coverage, there have been no reports of active exploitation of this vulnerability. Nevertheless, the potential for exposure during sensitive conversations makes this a critical concern. Updating the application addresses the underlying software risk, and users can take additional practical precautions by visually confirming that call and microphone indicators have ceased before discussing private information in proximity to their device.

What You Should Do

• Update Signal Immediately: Ensure all Signal applications on your mobile devices and computers are updated to the latest available version. This is the most crucial step to mitigate the risk.
• Verify Call Termination: After ending a call, visually confirm that all call indicators (e.g., call timer, microphone icon) have disappeared from your screen before discussing sensitive information near your device.
• Developers Using RingRTC: If you are a developer integrating RingRTC into your applications, ensure you are using version 2.72.0 or later to benefit from the implemented fixes.
• Stay Informed: Keep an eye on official Signal announcements for any further updates or recommendations regarding this or future vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.