Signal Patches RingRTC Flaw That Kept Calls Open After Hang-Up

Signal shipped a fix for a critical flaw in its RingRTC calling library that could keep audio and possibly video running after a user hung up, Shattered reported on October 30. The bug, CVE-2026-113380, scored 9.3 on the CVSS 4.0 scale and affected RingRTC versions before 2.72.0. MITRE published the record on October 20, 2026, while the fix had landed in RingRTC 2.72.0 on September 4. Shattered said no one has reported exploitation in the wild, and CISA has not added the flaw to its Known Exploited Vulnerabilities catalog. Administrators should update Signal on Android, iOS and Desktop to the newest release and make sure RingRTC is 2.72.0 or later.

RingRTC uses a finite-state machine and an event queue for calls. A malicious remote participant can flood that queue with events, so a hang-up request waits behind the flood and never reaches the termination step. The user sees the call end, but the underlying media stream may keep transmitting. The flaw does not break encryption; Signal remains end-to-end encrypted, but the attacker is already a call participant and can keep receiving an encrypted stream the victim meant to stop.

The September 4 patch, committed by a developer using the handle jim-signal, adds an independent termination flag so teardown does not depend on the congested queue. It also adds five-second shutdown limits and allows cleanup to continue even if one termination step fails. These changes force the call to close even when the queue is flooded.

Every RingRTC version before 2.72.0 is vulnerable, and version 2.72.0 or later fixes it. The Android, iOS and Desktop Signal clients all use the component and need a patched build. As of October 30, Shattered noted that public sources did not name the exact Signal app builds that embed the fixed library, so administrators should update each client and verify the RingRTC version if they embed it.

Exploitation status remains quiet. Reporting through late October found no known in-the-wild attacks, and CISA had not listed CVE-2026-113380 in its KEV catalog, according to Shattered. Quiet exploitation would be hard to detect because a user has no reason to check the microphone after seeing a call end. The attacker must be a participant in the call, which limits mass abuse.

A hunting query associated with CVE-2026-109618 and CVE-2026-109619 looks for post-exploitation command execution within PHP web server or worker processes, according to notes in the query, and is not specific to those CVEs.