BrevFeed
Sign in
← All stories
● Covered by 1 source · 1 reportMedium impact1 neutral

Signal Fixes Critical Vulnerability Allowing Malicious Callers to Block Hang-Ups

🔄 Updated 15d ago
Aggregated by BrevFeed security · updated 16d ago
🔖 Save
New to BrevFeed? We gather this story from every outlet covering it into one summary — ranked by real-world impact, not just the latest headline — so you never miss what matters. What is BrevFeed? →

Key points

  • Signal fixed CVE-2026-113380 in RingRTC library.
  • Vulnerability allowed attackers to prevent call termination.
  • Attackers could maintain audio/video access after hang-up.
  • Fixed in RingRTC version 2.72.0, released September 4.

Vulnerability Discovered and Resolved

Signal addressed a critical-severity vulnerability, tracked as CVE-2026-113380 with a CVSS score of 9.3, affecting its RingRTC open-source library used for voice and video calls. This flaw allowed a malicious caller to prevent a call from terminating, keeping audio and video tracks enabled even after the user hung up. The issue was resolved in RingRTC version 2.72.0, released on September 4.

Technical Details of the Flaw

The vulnerability stemmed from how RingRTC's Finite State Machine (FSM) handled call termination events. A hang-up was treated as an event in the FSM's queue, not an immediate kill switch. Attackers could flood this queue with junk events, causing the hang-up event to be indefinitely delayed. This lack of rate limiting on peer-originated events and the absence of priority for hang-up events allowed an attacker to maintain an active connection to a target's microphone and potentially camera, despite the victim believing the call had ended.

Impact and Resolution

Exploiting this vulnerability meant an attacker could continue receiving audio and video from a target device without the target's knowledge. Signal resolved the issue by ensuring that call termination requests are detected independently and are not blocked within the FSM's event queue. Users are advised to update their Signal applications promptly and to check call indicators to confirm calls have ended.

✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →

Keep reading

security Adobe Patches Critical ColdFusion and Campaign Classic Vulnerabilities Amid Exploits 12h ago security SS7 and Diameter Signaling Flaws Enable Tracking, Interception, and Impersonation 8d ago security CISA Alerts on Active Exploitation of Multiple Microsoft SharePoint Vulnerabilities 1d ago security ClickFix Social Engineering Attack Raises Cybersecurity Concerns 8m ago security Node.js Updates Fix Brotli Decoder RCE Vulnerability Across Supported Versions 10d ago

The daily brief

One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.

One email a day. Unsubscribe in one click, any time.

Today's brief

Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.

~4 min · 3 stories · Nov 07

▶ Play today's brief Listen on Spotify

New every morning, and the back catalogue is archived by date.

Primary sources

GitHub Imahian/Notes GitHub signalapp/ringrtc CVE CVE-2026-1133809.3 CRITICAL

Reporting from

SecurityWeek — Signal Vulnerability Lets Malicious Callers Block Hang-Ups 16d ago →

Signal resolved a critical-severity vulnerability (CVE-2026-113380) in its RingRTC library that allowed malicious callers to keep audio and video tracks active even after a user attempted to end a call. This flaw meant a remote attacker could prevent call termination, potentially maintaining access to a target's microphone and camera, and was fixed in RingRTC version 2.72.0.