Executive Summary
A critical vulnerability tracked as CVE-2026-113380 has been identified in Signal’s RingRTC calling library, affecting Android, iOS, and desktop clients. The flaw, which carries a CVSS score of 9.3, is a denial-of-service (DoS) condition that prevents the application from properly processing hangup commands. If exploited, the vulnerability allows a device's microphone and camera to remain active even after a user believes the call has terminated.
The technical root cause is improper handling of exceptional conditions (CWE-754) within the library's state machine. By saturating the event queue, an attacker ensures that termination requests are queued behind a flood of other events and effectively ignored. This creates a severe privacy risk, as the user interface may indicate the call has ended while covert audio and video capture continues.
While no in-the-wild exploitation has been confirmed, a Python-based proof of concept is available on GitHub. Signal released a fix in RingRTC version 2.72.0 in September 2026, which introduces a separate path for termination requests and a timeout mechanism. Organizations and individuals using Signal should ensure all clients are updated to version 2.72.0 or later to mitigate this risk.
Key Details
Threat Name
CVE-2026-113380
Affects
Signal RingRTC versions before 2.72.0, Signal for Android, Signal for iOS, Signal Desktop
Adversary
—
MITRE Techniques
—
Malware/Tools
None identified