A critical flaw in Signal's RingRTC calling library can interfere with local call termination when a remote call peer saturates its event queue. The practical concern is confidentiality: audio, and potentially video, may remain active after a user tries to hang up. Organizations should update Signal clients and verify that calls actually end rather than treating a tap on the hang-up control as sufficient assurance.
This is a follow-up on a vulnerability disclosed October 20, 2026, not evidence of a newly discovered attack on October 29. The reviewed sources do not establish exploitation in the wild.
What is confirmed
The MITRE CNA record for CVE-2026-113380 identifies RingRTC versions before 2.72.0 as affected and assigns a critical CVSS 4.0 score of 9.3. It describes a peer saturating a call's finite-state-machine queue so that local hang-up cannot reliably tear down the call and its media tracks.
The Signal project fix, titled 'Ensure calls terminate completely in corner cases,' adds an out-of-band termination-request check and a bounded wait for termination. The patch supports the central defensive lesson: ending a call must not depend solely on processing the normal backlog of events.
Who should check exposure
Teams using Signal for business conversations should inventory installed mobile and desktop clients, including secondary devices that may update less frequently. Developers embedding RingRTC should verify that their shipped application uses 2.72.0 or later. RingRTC's version is a library version, not a Signal application version; the reviewed material does not provide a complete platform-by-platform list of fixed Signal client releases.
For SMBs and government contractors, the immediate issue is the sensitivity of conversations held near a device after a call appears to end. This finding is not a reason to move regulated or controlled information onto an unapproved messaging service. Continue to follow contractual handling requirements and your organization's approved communications policy.
Evidence limits matter
The public technical explainer includes a synthetic, offline queue demonstration. Its author explicitly says it uses no network or real calls and is not an exploit. It illustrates the failure pattern, not a demonstrated end-to-end attack against a deployed Signal client.
The CISA enrichment in the CVE record listed exploitation as 'none' on October 20. That dated assessment is not proof that attacks are impossible or that no later activity exists. Nothing in the reviewed sources establishes a victim count, a threat actor, silent call initiation, or a break in Signal's encryption.
Actions for lean security teams
- Update every client. Install current Signal updates through official distribution channels on both phones and desktops. Do not assume an updated phone also updates a linked desktop.
- Verify the dependency where you build software. Confirm the deployed artifact embeds RingRTC 2.72.0 or later, not merely that a development manifest was edited.
- Check termination before sensitive discussion. Confirm the call indicator has disappeared and review device microphone or camera activity indicators. If media activity persists unexpectedly, stop the application and involve IT before resuming confidential conversation.
- Record anomalies without manufacturing certainty. Preserve client version, device details, timing and the visible symptoms. A lingering indicator warrants investigation; it does not by itself identify an attacker or prove that someone received audio.
- Improve update ownership. Assign responsibility for communications-client updates and include secondary endpoints in the check. For custom calling applications, test hang-up behavior under event pressure and failure conditions.
Bulwark assessment
The useful response is a targeted client and dependency check, not an unsupported claim of widespread eavesdropping. Strong encryption protects the communication channel; it does not replace reliable endpoint control over when capture and transmission stop. A security-critical stop operation needs a path that remains effective under load.
Prioritize devices used for confidential calls, document update completion, and keep the distinction between a disclosed design flaw, a conceptual demonstration and confirmed exploitation explicit.