Ethical Hacking News
A critical vulnerability has been discovered in the Signal messaging application, which could potentially allow a malicious caller to interfere with call termination, leaving the victim's microphone and camera active after they believe the conversation has ended. This vulnerability affects versions before 2.72.0 of the library RingRTC and can be mitigated by updating to the latest available Signal release. Users are advised to take prompt action to protect themselves and their personal data from potential exploitation of this vulnerability.
A critical vulnerability has been found in the Signal messaging application that could allow a malicious caller to interfere with call termination. The vulnerability, tracked as CVE-2026-113380, has a CVSS score of 9.3 out of 10, indicating a high level of severity and impact. The vulnerability stems from how Signal's calling library, RingRTC, handles events in the finite-state machine (FSM) that manages a call. The vulnerability can lead to a situation where the local hang-up operation is delayed, allowing the malicious caller to continue sending events and potentially keeping the microphone active and possibly the camera too. Users should install the latest available Signal release for their device to avoid the vulnerability. Updating Signal promptly is a sensible precaution, especially for people who use it to discuss sensitive matters.
The world of cybersecurity has witnessed a plethora of vulnerabilities and exploits in recent times, with various software applications and systems being targeted by malicious actors. Among the recent discoveries, a critical vulnerability has been found in the Signal messaging application, which could potentially allow a malicious caller to interfere with call termination, leaving the victim's microphone and camera active after they believe the conversation has ended.
This vulnerability, tracked as CVE-2026-113380, has a CVSS score of 9.3 out of 10, indicating a high level of severity and impact. According to the technical report published on GitHub, the vulnerability stems from how Signal's calling library, RingRTC, handles events in the finite-state machine (FSM) that manages a call. The application places events in a queue for processing, but a malicious peer can flood that queue with events and prevent the local hang-up operation from being handled in a timely manner.
This highlights a security problem that deserves attention beyond a single messaging application: ending a call should be an immediate control action, not something that can be delayed by traffic coming from the other participant. The fact that the application places events in a queue for processing can lead to a situation where the local hang-up operation is delayed, allowing the malicious caller to continue sending events and potentially keeping the microphone active and possibly the camera too.
The report explains that the underlying problem is not that Signal's end-to-end encryption has been broken. Rather, it concerns the handling of call state and the reliable termination of a session. Encryption cannot protect users from every flaw in the software that controls when a communication session begins or ends.
The vulnerability affects versions before 2.72.0 of the library RingRTC, which the messaging app uses to provide voice and video calling. It can affect Signal clients that embed a vulnerable build of the library, and users should install the latest available Signal release for their device rather than relying on the library version alone.
It is essential to note that the fact that the vulnerability has been made public does not mean attackers are already exploiting it. However, because it could expose private conversations, updating Signal promptly is a sensible precaution, especially for people who use it to discuss sensitive matters.
The technical report also includes a conceptual Python proof of concept, which models the difference between a queue in which a flood can bury a hang-up event and one in which critical events receive priority. The demonstration is synthetic and offline, with no network activity or real calls, so it illustrates the underlying logic rather than providing a working exploit.
In conclusion, the critical Signal vulnerability is a serious issue that highlights the importance of software security and the need for prompt updates and patches. As cybersecurity threats continue to evolve and become more sophisticated, it is essential for users to stay vigilant and take proactive measures to protect themselves and their personal data.
Related Information:
https://www.ethicalhackingnews.com/articles/Critical-Signal-Vulnerability-Exposes-Microphone-and-Camera-to-Malicious-Interference-ehn.shtml
https://securityaffairs.com/201490/security/signal-vulnerability-could-keep-calls-alive-after-users-hang-up.html
https://privacysavvy.com/news/privacy/signal-call-hang-up-vulnerability/
Published: Thu Oct 22 14:20:28 2026 by llama3.2 3B Q4_K_M
