Signal Vulnerability Allows Eavesdropping After Call Ends
A critical flaw in Signal's RingRTC library could allow attackers to continue listening to users even after a call has been terminated.
A critical vulnerability, identified as CVE-2026-113380, has been discovered in Signal's RingRTC library, a core component responsible for its voice and video calling functionality. This flaw, carrying a severe CVSS score of 9.3, affects all versions of RingRTC prior to 2.72.0 and poses a significant risk to user privacy.
The vulnerability stems from an issue in how the RingRTC library handles the termination of calls. According to security researchers, a malicious participant in a call can exploit this by overwhelming the call's internal event queue. This interference can disrupt the normal process of disconnecting the call when one party hangs up, potentially leaving the audio channel open.
The primary concern is that an attacker could continue to eavesdrop on conversations even after the intended participants believe the call has ended. This could expose sensitive off-the-cuff remarks, private discussions with others in the vicinity, or any other audio the user thought was no longer being transmitted. While the vulnerability description mentions that video might also remain active, it does not provide specific details on how this would manifest or what users might see.
Fortunately, there are no known reports of this vulnerability being exploited in the wild. The flaw is specifically related to the call termination process and does not involve compromised accounts, stolen credentials, or exposed message histories, meaning users do not need to reset passwords or take other account-level security measures beyond updating the application.
Signal's developers have already addressed the vulnerability by updating the RingRTC library. The fix ensures that the shutdown process is more resilient, even when the call's internal queue is full or other termination steps encounter failures. This update aims to prevent the call from remaining active under such conditions.
Users are strongly advised to update their Signal applications to the latest available version to ensure they are protected. While the exact Signal app versions that include the fix are still being confirmed publicly, the underlying RingRTC library has been patched. Users on Android have reported receiving updates that likely include the fix, and while confirmation for iOS is pending, enabling automatic updates is recommended.
This vulnerability highlights the ongoing challenges in securing real-time communication platforms. Even with robust end-to-end encryption, flaws in call management and termination protocols can create unexpected privacy risks. The swift patching by Signal demonstrates a commitment to user security, but it also serves as a reminder for users to maintain updated software across all applications.
For users concerned about their privacy, it is always best practice to ensure Signal and all other communication applications are kept up-to-date. This proactive measure is the most effective way to protect against newly discovered vulnerabilities like the one affecting the RingRTC library.