CVE-2026-113380 Vulnerability: Critical Issue in Signal Calls

The CVE-2026-113380 vulnerability affects the RingRTC library used by Signal. A peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.

The severity is classified as critical with a CVSS score of 9.3. According to signals on X, 3 posts have been recorded in the last 24 hours with a total of 41 interactions. The most cited text indicates that a critical bug in Signal allowed the other person on a call to keep listening after you hung up. Flooding the call's event queue could stall your hang-up, leaving your mic and possibly your camera live. Signal patched CVE-2026-113380 on Android in September. No attacks are known to be actively exploited.

In defense, it is crucial to promptly apply the patch and update to RingRTC version 2.72.0 or later. It is also advisable to monitor communications for any anomalies in calls and verify that devices are updated with the latest security fixes.