A vulnerability in Signal could allow a malicious participant to continue receiving audio even after the other person ends a call. The issue affects the RingRTC library, responsible for the app's voice and video calls, and was publicly disclosed on October 20, 2026, when a fix was already available.
The flaw, identified as CVE-2026-113380, received a critical rating, with a score of 9.3 on a scale of 10. According to the alert issued by the Italian CSIRT and reproduced by CSIRT Toscana, the vulnerability could prevent a connection from being properly terminated, exposing conversations and ambient sounds without the user noticing.
The problem lies in the processing of the internal events that control the state of a call. A malicious participant could overload the RingRTC event queue, causing a hang-up request not to be executed correctly. As a result, the person who ended the conversation could believe the communication had ended, even though audio transmission remained active.
The technical documentation also points to the possibility of video transmission continuing, but this behavior was not confirmed in the same way as the risk involving audio. Nor is it established how long a connection could remain open under these conditions.
The vulnerability does not represent a break in Signal's encryption. The risk lies in call management: even with the content protected during transmission, a connection that should have been ended could continue sending information to the other participant.
The fix was incorporated into version 2.72.0 of RingRTC. The code published in the Signal repository introduces specific signaling for termination requests and a five-second wait limit, so that failures in event processing do not indefinitely prevent the call from ending.
Which versions of Signal fix the vulnerability
The technical alert published on October 20 identifies vulnerable versions in the three main environments where Signal is available.
On Android, the affected versions are those prior to 8.27.0. On iOS, the reported cutoff is version 8.30.0, while on Signal Desktop the issue affects versions prior to 8.29.0. The RingRTC library, used by the apps, must be at version 2.72.0 or later.
These references appear in the security advisory reproduced by CSIRT Toscana. The report published by The Register on October 21, however, noted that the exact dates on which the corrected library was incorporated into each platform were not completely clarified in Signal's public notes.
Therefore, the recommendation is to update Signal to the latest available version, on both mobile devices and computers, instead of relying only on the minimum numbers reported in the alert.
As of the disclosure of the technical information, there was no public evidence of exploitation of the vulnerability in real attacks. The scenario described represents a technical possibility of information exposure, not a confirmation that users' calls were intercepted or kept open clandestinely.
