Signal Vulnerability Allowed Malicious Callers to Block Hang-Ups
A critical vulnerability in Signal's open-source RingRTC library allowed attackers to prevent users from ending calls, potentially keeping microphones and cameras active.
Signal has addressed a critical security flaw within its open-source RingRTC library that could have allowed malicious callers to prevent legitimate users from terminating calls. The vulnerability, identified as CVE-2026-113380 and carrying a CVSS score of 9.3, impacted the call termination functionality, creating potential denial-of-service scenarios.
The core of the issue lay in how the RingRTC library, which is based on WebRTC, handled call termination events. Researchers discovered that a remote peer could flood the call's Finite State Machine (FSM) event queue with extraneous data. Crucially, the hang-up action was not treated as an immediate kill switch but rather as another event to be processed. This meant that a hang-up request could be indefinitely delayed if the event queue was overwhelmed with attacker-generated noise.
"Flood the queue with junk and the hang-up waits behind attacker noise forever, so the call (microphone, possibly camera) is never torn down," explained a researcher in a GitHub write-up. This mechanism allowed an attacker to maintain an active audio and video connection from a victim's device, even when the victim believed the call had ended. The implications for user privacy and security were significant, as it could lead to unauthorized eavesdropping or surveillance.
The vulnerability was resolved with the release of RingRTC version 2.72.0 on September 4. While the fix was implemented earlier, details of the flaw and a conceptual proof-of-concept were published on Tuesday, coinciding with NIST's addition of the CVE to the National Vulnerability Database. Signal's developers addressed the issue by ensuring that call termination requests are no longer blocked in the FSM's event queue and are now detected and processed independently, irrespective of other queued events.
Users are strongly advised to update their Signal applications to the latest version to ensure they are protected against this vulnerability. In the interim, users should remain vigilant and check the call indicator within the application to confirm that a call has indeed terminated before assuming privacy is restored. The resolution of this bug underscores the importance of robust event handling and prioritization in real-time communication systems.
This incident highlights the ongoing challenges in securing real-time communication platforms, where complex libraries like WebRTC can harbor subtle but impactful vulnerabilities. The open-source nature of RingRTC, while beneficial for transparency and community review, also means that vulnerabilities, once discovered, can be widely understood and potentially exploited if patches are not applied promptly. The prompt disclosure and resolution by Signal, however, demonstrate a commitment to user security.