{ "site": "https://pwn.watch", "generatedAt": "2026-10-22T16:53:33.742Z", "tag": { "id": "signal", "label": "Signal", "isStack": false, "url": "https://pwn.watch/t/signal", "feed": "https://pwn.watch/t/signal/feed.xml" }, "counts": { "incidents": 1, "live": 0, "notFullyPatched": 0, "patched": 1 }, "incidents": [ { "slug": "signal-ringrtc-cve-2026-113380", "title": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)", "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380", "json": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Signal (RingRTC calling library, @signalapp/ringrtc)", "tags": [ "rust", "npm", "ios", "android", "signal" ], "cveIds": [ "CVE-2026-113380" ], "affectedVersions": [ "RingRTC before 2.72.0 (Signal Android, iOS and Desktop clients embedding it)" ], "fixedVersions": [ "RingRTC 2.72.0 (update Signal on every device)" ], "startedAt": "2026-10-20", "closedAt": "2026-10-22T18:00:43+02:00", "updatedAt": "2026-10-22T18:00:43+02:00", "summary": "A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation.", "xPost": null } ], "posts": [ { "authorName": "Cybersecurity News Everyday", "handle": "TweetThreatNews", "avatarUrl": "https://pbs.twimg.com/profile_images/2043130207125848064/YaxtN2hq_bigger.jpg", "text": "CVE-2026-113380 affects RingRTC versions before 2.72.0 and could let a call participant keep hearing audio after hang-up. No in-the-wild exploitation is known; users are advised to update Signal.", "date": "2026-10-21T22:48:16.000Z", "url": "https://x.com/TweetThreatNews/status/2113039694753636745", "media": [], "incident": "signal-ringrtc-cve-2026-113380" }, { "authorName": "tsn_hub", "handle": "tsnmediahub", "avatarUrl": "https://pbs.twimg.com/profile_images/1892172141111496704/d_EnIiZO_bigger.jpg", "text": "📵 Update Signal. A critical flaw in its RingRTC calling library could stop a call ending when you hang up, leaving audio and perhaps video running, per its CVE record. RingRTC 2.72.0 fixes it. There's no report of exploitation.\n\nSource: CVE-2026-113380 record", "date": "2026-10-21T18:52:01.000Z", "url": "https://x.com/tsnmediahub/status/2112980243162026149", "media": [], "incident": "signal-ringrtc-cve-2026-113380" } ], "changes": [ { "incident": "signal-ringrtc-cve-2026-113380", "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2026-10-22", "title": "No known exploitation; CISA has not added it to KEV and NVD lists it as awaiting analysis.", "body": null, "sourceUrl": "https://www.helpnetsecurity.com/2026/10/22/signal-ringrtc-vulnerability-cve-2026-113380/", "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380" }, { "incident": "signal-ringrtc-cve-2026-113380", "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2026-10-22", "title": "SecurityWeek: the hang-up was queued behind peer events with no rate limit or priority; the fix makes call termination bypass the queue. Users should update Signal and check the call indicator after hanging up.", "body": null, "sourceUrl": "https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/", "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380" }, { "incident": "signal-ringrtc-cve-2026-113380", "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2026-10-22", "title": "Closed on pwn.watch: the fix shipped Sep 4 (RingRTC 2.72.0), there is still no known exploitation and no new developments, so this is now a patch-and-move-on item. Make sure Signal is updated on every device.", "body": null, "sourceUrl": "https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/", "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380" }, { "incident": "signal-ringrtc-cve-2026-113380", "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2026-10-21", "title": "Researcher Imahian's write-up and conceptual PoC circulate; press coverage begins.", "body": null, "sourceUrl": "https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528", "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380" }, { "incident": "signal-ringrtc-cve-2026-113380", "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2026-10-20", "title": "CVE-2026-113380 published by MITRE (CVSS 4.0 9.3); fix is RingRTC 2.72.0.", "body": null, "sourceUrl": "https://www.cve.org/CVERecord?id=CVE-2026-113380", "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380" }, { "incident": "signal-ringrtc-cve-2026-113380", "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2026-09-04", "title": "Signal quietly fixes the bug in RingRTC 2.72.0 (commit \"Ensure calls terminate completely in corner cases\"), about six weeks before disclosure.", "body": null, "sourceUrl": "https://github.com/signalapp/ringrtc/commit/4b1b6fa53c9f30c87c8ea78e44675d4a13e1e4d3", "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380" } ] }