Ethical Hacking News
A recent security vulnerability in the Signal messaging app has exposed users to a potential threat, as a bug in the encrypted calling library could prevent a call from ending properly, leaving audio and possibly video active. In this article, we delve into the details of the vulnerability and provide guidance on how to update the app and protect yourself from potential harm.
A recent security vulnerability (CVE-2026-113380) has been discovered in the Signal messaging app. The vulnerability affects every version of Signal's open-source RingRTC library before 2.72.0. A denial-of-service attack on the library's event queue can prevent a call from ending properly. Users are advised to update their apps to the latest versions (RingRTC 2.72.0) to fix the issue. Malicious actors could potentially exploit this vulnerability to leave audio and video active after a call has ended.
A recent security vulnerability in the Signal messaging app has left users on high alert, as a bug in the encrypted calling library could potentially allow a malicious actor to prevent a call from ending properly, leaving audio and possibly video active. The vulnerability, designated as CVE-2026-113380, was published by MITRE on Tuesday and carries a CVSS score of 9.3, categorizing it as a critical issue in every single version of Signal's open-source RingRTC library before 2.72.0.
The RingRTC library, built on top of WebRTC, provides Signal-specific calling functionality using the already encrypted media traffic. However, a denial-of-service attack on the library's finite state machine (FSM) event queue can lead to an overwhelming of the event queue with requests, causing it to become overwhelmed and fail to process a hangup request, thereby preventing the call from terminating properly.
Signal users are advised to update their apps, specifically the mobile and desktop versions, to the latest versions, as the fixed version of RingRTC 2.72.0 allows the call's finite state machine (FSM) to detect termination requests independently of the event queue while adding a timeout to prevent stalled processing from indefinitely blocking a hangup. It is not entirely clear when the fixed version of RingRTC reached the Android, iOS, and desktop versions of the apps, with Signal's release history indicating that RingRTC 2.72.0 was incorporated in September, but the precise rollout dates across all platforms remain unclear.
In light of this vulnerability, experts caution users to exercise extreme caution when making calls on Signal, as a malicious actor could potentially exploit this vulnerability to leave audio and possibly video active even after a call has ended. Moreover, users are advised to ensure their installations are updated to prevent any potential vulnerabilities.
This vulnerability serves as a stark reminder of the importance of regular software updates and the need for users to stay vigilant when using any software application that handles sensitive information. As with any software vulnerability, users are urged to take immediate action to protect themselves from potential harm.
Related Information:
https://www.ethicalhackingnews.com/articles/Signal-Messaging-App-Vulnerability-Exposed-A-Call-for-Caution-and-Urgent-Updates-ehn.shtml
https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528
https://nvd.nist.gov/vuln/detail/CVE-2026-113380
https://www.cvedetails.com/cve/CVE-2026-113380/
Published: Wed Oct 21 18:13:02 2026 by llama3.2 3B Q4_K_M
