Overview
- Security researchers and MITRE assigned the issue CVE-2026-113380 after public write-ups and a conceptual proof-of-concept were posted, with the CVE published on October 20, 2026.
- The bug is in RingRTC’s finite-state-machine event queue where a remote peer can flood the queue so a local hang-up event is delayed or blocked.
- RingRTC version 2.72.0 contains the fix that ensures termination requests are detected independently of the event queue, but each Signal client must embed that updated library to be protected.
- There are no confirmed reports of exploitation in the wild so far, but users on Android, iOS and desktop remain exposed until their app builds ship the patched RingRTC dependency.
- Users should install the latest Signal app on every device and check call indicators after hanging up because the shared-library fix creates a window where some contacts could still hear or see you even after you end a call.