Encrypted messaging giant Signal has successfully resolved a critical-severity security vulnerability that could have allowed a malicious caller to bypass a user’s attempt to hang up, keeping audio and video feeds active without the victim’s knowledge or consent. The serious flaw highlights the complex challenges developers face when securing real-time communication protocols against sophisticated denial-of-service and state-manipulation techniques.<\/p>\n
The security defect has been officially tracked under the identifier CVE-2026-113380 and carries a severe Common Vulnerability Scoring System (CVSS) rating of 9.3 out of 10, placing it firmly in the critical tier. The vulnerability impacts RingRTC, the specialized open-source library that Signal utilizes to power its secure voice and video calling features. RingRTC itself is built upon WebRTC, a widely adopted framework enabling real-time communications across browsers and mobile applications.<\/p>\n
The underlying root cause of the vulnerability stems from how the calling library manages state transitions during active communication sessions. Specifically, a remote peer participating in a call could intentionally flood the Finite State Machine (FSM) event queue with a barrage of junk data and spurious events. Because of the sheer volume of incoming noise, the application’s internal logic failed to process legitimate call-termination requests in a timely manner, effectively preventing the call from terminating as expected.<\/p>\n
Technical write-ups and analyses published by security researchers on GitHub shed further light on the exact mechanics of the exploit. According to these findings, the vulnerability existed because a user’s action to hang up was not treated as an immediate kill switch capable of overriding ongoing processes. Instead, the hang-up request was simply queued as a standard event to be processed sequentially within the FSM event queue. Compounding the issue was the absence of any effective rate-limiting mechanisms for peer-originated events, alongside the glaring omission of a priority system that would ensure a termination request cuts ahead of routine traffic.<\/p>\n
As a security researcher noted in a public GitHub documentation breakdown of CVE-2026-113380, an attacker could flood the queue with junk data and cause the hang-up command to wait behind the attacker-generated noise indefinitely. As a direct consequence of this queue starvation, the call infrastructure\u2014including the microphone and potentially the camera feed\u2014was never properly torn down, leaving the communication channel open.<\/p>\n
By successfully exploiting this vulnerability, a malicious actor could maintain audio and video streams flowing outward from a target device even after the victim had pressed the end-call button and believed the session was securely closed. This privacy breach poses significant risks, as users often rely on secure applications like Signal under the assumption that ending a call completely severs data transmission.<\/p>\n
Prompt remediation efforts by the development team led to the release of RingRTC version 2.72.0 on September 4, which effectively patches the security defect. However, comprehensive technical details regarding the flaw, alongside a conceptual proof-of-concept demonstration, were publicly disclosed on Tuesday. Simultaneously, the National Institute of Standards and Technology formally added the CVE identifier to the National Vulnerability Database, bringing widespread industry attention to the issue.<\/p>\n
Signal addressed the core architectural flaw by redesigning how termination requests are handled within the application framework. The updated implementation ensures that call-termination requests no longer remain blocked behind other traffic in the Finite State Machine’s event queue. Instead, these critical requests are now detected independently, guaranteeing that an end-call command functions as intended regardless of any network-level noise or malicious queue flooding attempted by a remote peer.<\/p>\n
Security professionals strongly recommend that all users update their Signal applications to the latest available version as soon as possible to ensure protection against this vulnerability. In the interim or as a general best practice, users are advised to pay close attention to active call indicators on their devices to verify that calls have indeed terminated completely after hanging up.<\/p>\n","protected":false},"excerpt":{"rendered":"
Encrypted messaging giant Signal has successfully resolved a critical-severity security vulnerability that could have allowed…<\/p>\n","protected":false},"author":19,"featured_media":2478,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[313],"tags":[1221,2010,2015,323,2012,2011,201,1568,321,2013,320,2014,1984,322,2016,773],"class_list":["post-2479","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-incident-response-forensics","tag-active","tag-allowed","tag-audio","tag-blockchain-analysis","tag-bypass","tag-callers","tag-critical","tag-fixes","tag-forensics","tag-hang","tag-incident-response","tag-keep","tag-signal","tag-tracking","tag-video","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/2479","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2479"}],"version-history":[{"count":0,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/2479\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/media\/2478"}],"wp:attachment":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2479"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2479"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2479"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}