Signal RingRTC flaw CVE-2026-113380 can keep calls live after hang-up

What happened

Signal fixed a flaw in RingRTC, the open-source library that runs Signal voice and video calls. It is tracked as CVE-2026-113380.

A malicious call peer could fill the call's internal event queue. Your hang-up might then not fully tear the call down. The audio track, and perhaps video, could keep running after you think the call ended.

The fix landed in RingRTC 2.72.0 on 4 September 2026. The CVE was published on 20 October 2026, about six weeks later. Details are now public.

Who is affected

The CVE record lists RingRTC before 2.72.0 as affected. Every Signal app uses RingRTC for calls: Android, iOS and Desktop.

Signal has not published affected app versions. ThreatWire checked which RingRTC version each Signal release pins in Signal's public source code. The first releases with RingRTC 2.72.0 or later are:

• Signal Android: 8.27.0
• Signal iOS: 8.30 (build 8.30.0.1882)
• Signal Desktop: 8.29.0

Older app versions bundle an affected RingRTC. Current Signal releases ship RingRTC 2.72.1 or 2.73.0. Developers who embed RingRTC directly should move to 2.72.0 or later.

What is confirmed

RingRTC manages each call with state machines that process events from a bounded queue of 256 entries. The fix commit shows that, before 2.72.0, ending a call could stop early if one step failed. A full queue made the termination event fail to send. The remaining cleanup then never ran.

Signal's patch adds a separate termination flag that the state machines check directly, outside the queue. It caps shutdown waits at five seconds. Cleanup now continues even if a step fails. New tests flood the queues and check that hang-up closes the connection and turns off outgoing audio.

The commit is titled "Ensure calls terminate completely in corner cases". It was written by Signal engineer Jim Gustafson. The RingRTC changelog lists it under 2.72.0 with no security note.

The CVE record scores the flaw CVSS 4.0 9.3 (Critical). It maps it to CWE-754, improper check for unusual or exceptional conditions. The bug affects how a call ends. It does not touch Signal's encryption, messages or accounts.

What is not confirmed

Who scored it. The CVE was filed through MITRE's request form, not by Signal. Signal has not published an advisory, a score or release notes for it. NVD has not analyzed it yet. VulDB rates it lower and calls it resource consumption. Expect the score to be debated.

Real-world impact. The CVE says video is "perhaps" affected. No source explains what an affected user would see on screen, or how long media could keep flowing.

Credits. No reporter is credited in the CVE record. Credits are not published yet.

Exploitation. The CVE is not in the CISA KEV catalog as of 22 October. CISA's assessment in the CVE record lists exploitation as none. No attacks have been reported.

PoC. A write-up on GitHub, linked from the CVE record, includes a short Python script. ThreatWire reviewed the code and the account without running anything. The script is a synthetic offline model of a queue. It does not touch the network, Signal or RingRTC, and we found no malware signs. It explains the idea but does not demonstrate the real bug. We do not count it as a working PoC. ThreatWire has not run it.

What to do now

1. Update Signal on every device. Install the latest version from Google Play, the App Store or Signal's Desktop updater. At minimum, run Android 8.27.0, iOS 8.30 or Desktop 8.29.0.
2. Check linked devices. Signal Desktop and iPad installs update separately from your phone. Restart Desktop to apply a pending update.
3. Fleet admins: use MDM or your software inventory to find Signal builds below those versions. Push updates and block outdated builds where policy allows.
4. Developers embedding RingRTC: upgrade to RingRTC 2.72.0 or later and rebuild.
5. Until you have updated, treat calls with unknown or untrusted contacts with care. After hanging up, confirm the call screen and the microphone indicator are gone before speaking about anything sensitive.

Related coverage

Full record: CVE-2026-113380 on ThreatWire.

Other messaging-app flaws we covered: Telegram Desktop one-click file theft (CVE-2026-107181). Browse the CVE tracker and actively exploited CVEs.

Sources: RingRTC's fix commit, changelog and npm releases, Signal's Android, iOS and Desktop source repositories, CVE.org, NVD, GitHub Advisory Database, the CISA KEV catalog, VulDB, Malwarebytes, CyberInsider and the Imahian/Notes write-up. Links are in the references list.