As reported by SecurityAffairs, a critical vulnerability in Signal's RingRTC calling library—tracked as CVE-2026-113380 with a CVSS score of 9.3—allows a malicious call participant to prevent call termination by flooding the finite-state machine's event queue, potentially leaving the victim's microphone and camera active indefinitely after they press hang-up. This is not an encryption failure. It is something arguably worse: a failure of the trust model governing session lifecycle control.
Vulnerability Details
| Field | Detail |
|---|---|
| CVE | CVE-2026-113380 |
| CVSS | 9.3 (Critical) |
| Affected Component | RingRTC library (Signal's voice/video calling engine) |
| Affected Versions | RingRTC < 2.72.0; Signal Android < 8.27.0; Signal iOS < 8.30.0; Signal Desktop < 8.29.0 |
| Patch Status | Fixed in RingRTC 2.72.0+ and corresponding client updates |
| Active Exploitation | No confirmed in-the-wild exploitation reported at time of disclosure |
| Attack Vector | Remote — requires active call with victim; attacker floods FSM event queue |
Why This Matters Beyond Signal
The core design flaw here is architecturally significant. Signal's RingRTC treats a local hang-up as just another event in a finite-state machine queue, with no priority lane and no rate-limiting on peer-originated events. The remote participant can stuff the queue with junk events, and the hang-up operation waits behind that noise. The result: the call session—microphone and potentially camera—remains live without the user's knowledge.
End-to-end encryption guarantees confidentiality of content in transit. It does nothing to guarantee that a session ends when a user commands it to. Session lifecycle control is a separate security property, and this vulnerability shows it has been treated as a second-class concern.
This pattern likely exists in other WebRTC-based calling platforms that use similar FSM-driven event processing. Any application where a remote peer can influence the order or timing of local session-termination events is potentially exposed to an analogous class of attack. Security teams should audit their own VoIP stacks for similar trust assumptions.
Who Is Most at Risk
- Journalists, activists, and dissidents — Signal's primary high-risk user base. An attacker who can keep a microphone hot post-hang-up gains persistent audio surveillance without needing to exploit the encryption layer.
- Enterprise users on unpatched Signal Desktop — desktop versions are frequently slower to update, and a compromised call could expose ambient office audio and video.
- Government and NGO personnel operating in adversarial environments where coordinated call-based surveillance is plausible.
Immediate Actions
- Update all Signal clients immediately: Android to 8.27.0+, iOS to 8.30.0+, Desktop to 8.29.0+. Verify the version in app settings.
- Force-close the application after sensitive calls on any device that cannot be immediately updated. Do not rely on the hang-up button alone.
- Revoke camera/microphone permissions at the OS level for Signal on devices where patching is delayed (iOS Settings > Privacy > Microphone/Camera; Android Settings > Privacy > Permission manager).
- Monitor for unusual post-call microphone or camera activity — on Android, check the green camera/microphone indicator in the status bar after hanging up.
- Audit WebRTC-based internal tools for the same FSM event-queue pattern. Look for rate-limited peer events and prioritized local control operations.
Shield53 Recommendations
Signal remains one of the most security-conscious messaging platforms available, and their response to this issue—patching and transparent disclosure—is commendable. But this vulnerability should prompt a broader industry conversation about session-termination guarantees in real-time communication protocols. We recommend:
- Treating local session teardown as a privileged, non-queueable operation in any RTC implementation. Hang-up should bypass the FSM or be processed with absolute priority.
- Implementing rate-limiting on all peer-originated events to prevent queue-flooding attacks across the board.
- Adding user-visible session state indicators that persist after hang-up, so users can detect when a session hasn't fully torn down.
- For organizations with high-risk users: deploy mobile device management (MDM) policies that enforce Signal version minimums and alert on outdated installs.
The lesson here is that encryption is necessary but insufficient. Session lifecycle integrity—the guarantee that a communication starts and stops when the user says it does—deserves the same rigorous threat modeling as the crypto itself. Platforms that have not yet audited their RTC state machines for this pattern should treat this as a priority.
