Critical Signal Bug Could Keep Microphones and Cameras Active After Calls
AI-generated image · US National Wire
A vulnerability in Signal's RingRTC library may allow calls to remain open without the user's knowledge, according to security reports.
A critical security vulnerability in the encrypted messaging app Signal could allow audio and video channels to remain active even after a user believes they have ended a call, as The Register first reported.
Reporting from The Register indicates that the flaw, identified as CVE-2026-113380, exists within Signal's open-source RingRTC library. This library is built on WebRTC, a standard for internet-based voice and video communication. According to The Register, the bug affects every version of the library prior to 2.72.0.
MITRE published the vulnerability on Tuesday, assigning it a CVSS score of 9.3, which classifies the issue as critical. The flaw is categorized as CWE-754, which refers to the improper checking for exceptional or unusual conditions.
As explained by The Register, the vulnerability functions as a denial-of-service attack on the finite state machine (FSM) event queue, the system responsible for managing call events. If a participant on a call saturates this queue with requests, the system can become overwhelmed and fail to process a hangup request. This prevents the call from terminating properly, potentially leaving the microphone and camera active on the other end without the user's knowledge.
While a conceptual proof of concept using a Python script has been shared via GitHub to simulate the event queue flooding, The Register notes that the CISA known exploited vulnerabilities catalog does not currently indicate the flaw has been exploited in the wild. The CVE report describes the attack complexity as low.
Signal released a fix in RingRTC version 2.72.0 last month, though the vulnerability was not made public until this week. The Register reports that the fix allows the FSM to detect termination requests independently of the event queue and introduces a timeout to stop stalled processing from blocking a hangup indefinitely.
While Signal Desktop's release history shows RingRTC 2.72.0 was integrated in September, The Register notes it is unclear exactly when the update reached iOS and Android users. Signal has not responded to requests for further information from The Register.