Cybersecurity News Everyday
@TweetThreatNews
CVE-2026-113380 affects RingRTC versions before 2.72.0 and could let a call participant keep hearing audio after hang-up. No in-the-wild exploitation is known; users are advised to update Signal.
// tag
Signal
Security incidents tagged Signal. Newest first.
- incidents
- 1
- live
- 1
- patched
- 1
## 1 Signal incident in the last year
through Oct 22, 2026crit 4 · high 3 · med 2 · low 1 · upd ½severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½lessmore
- criticallivepatchedsince Oct 20, 2026
Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)
› Signal (RingRTC calling library, @signalapp/ringrtc)
A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation.
CVE-2026-113380
## posts 2
- › Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)
- › Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)
tsn_hub@tsnmediahub📵 Update Signal. A critical flaw in its RingRTC calling library could stop a call ending when you hang up, leaving audio and perhaps video running, per its CVE record. RingRTC 2.72.0 fixes it. There's no report of exploitation. Source: CVE-2026-113380 record
