Threat reportVulnerabilityTL-2026-4117
Signal RingRTC Vulnerability (CVE-2026-113380) Can Keep Microphone Audio Active After Call Hang-Up
Signal RingRTC Vulnerability (CVE-2026-113380) Can Keep (TL-2026-4117) is a critical-severity software vulnerability scored CVSS 9.3, first published 2026-10-22. It has no confirmed attribution, affects Signal RingRTC (Signal calling library; Signal Android, iOS and, references 1 CVE (CVE-2026-113380), maps to 3 MITRE ATT&CK techniques (T1123, T1125, T1203), and is covered by 9 detection rules and 9 indicators of compromise.
- CVSS
- 9.3/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-4117
- Threat ID
- TL-2026-4117
- Severity
- CRITICAL
- CVSS
- 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:N/SA:N)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, journalism, civil society, technology, finance, health
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in Signal RingRTC Vulnerability (CVE-2026-113380) Can Keep
Malware and tooling: Desktop, RingRTC
How Signal RingRTC Vulnerability (CVE-2026-113380) Can Keep works
A flaw in Signal's RingRTC calling library lets a malicious call participant keep receiving a victim's audio (and possibly video) after the victim hangs up, by saturating the bounded 256-entry event queue of the call finite-state machine so the local hang-up event is never processed. Fixed in RingRTC 2.72.0.
CVE-2026-113380 is an improper check for unusual or exceptional conditions (CWE-754) in RingRTC, the calling library used by Signal's Android, iOS and Desktop clients. Each call is managed by finite-state machines (FSMs) that consume events from bounded queues of 256 entries. A local hang-up is not a kill switch: it is one more event placed at the back of the call's FSM event queue. Because there is no rate limit on peer-originated events and no priority lane for hang-up, a remote call participant can flood the queue with peer-originated events so the termination event is never processed.
The result is that the victim presses hang-up and believes the call has ended, while the local audio track (and possibly the video track) remains up and continues to flow to the malicious peer. NVD describes the issue as a peer saturating the call's FSM queue, which can interfere with the ability of a local hangup to tear the call down. The attacker must be an active call participant; passive observers cannot exploit it. NVD scores it CVSS v4.0 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:N/SA:N).
Additionally, the prior termination sequence could stop prematurely if an operation failed, and unsuccessful application notifications could interrupt subsequent cleanup. The fix (commit 4b1b6fa, 'Ensure calls terminate completely in corner cases', author jim-signal, authored 2026-09-04, shipped in RingRTC 2.72.0) adds an atomic terminate_requested flag independent of queue depth, a terminate_if_requested() check after each event, a 5-second TERMINATE_TIMEOUT (wait_timeout_while) on FSM shutdown waits, cleanup that continues despite failed termination operations, and regression tests (inject_pause, wait_for_fsm_terminated) simulating queue saturation and notification failures.
A third-party analysis (Imahian/Notes) includes a synthetic offline Python PoC that demonstrates the queue-blocking pattern without real network calls. The sources report no named threat actor, no network IOCs and no confirmed in-the-wild exploitation. The exact on-the-wire signaling messages used to saturate the queue are not specified in the sources.
MITRE ATT&CK techniques used in TL-2026-4117
Collection
T1123 Audio Capture; T1125 Video Capture
Execution
Affected products and versions in Signal RingRTC Vulnerability (CVE-2026-113380) Can Keep
- Signal — RingRTC (Signal calling library; Signal Android, iOS and Desktop clients)
Vulnerable versions: < 2.72.0
Fixed in: 2.72.0
Remediation for Signal RingRTC Vulnerability (CVE-2026-113380) Can Keep
Patches
- RingRTC 2.72.0 (commit 4b1b6fa53c9f30c87c8ea78e44675d4a13e1e4d3)
Immediate actions
- Update Signal Android, iOS and Desktop clients to builds that bundle RingRTC 2.72.0 or later
- Treat calls with untrusted participants as potentially still live after hang-up until clients are updated; close or force-quit the app, or disable the microphone permission if in doubt
Workarounds
- No vendor workaround documented in the sources; restricting calls to trusted contacts reduces exposure because exploitation requires an active malicious call participant
Longer-term hardening
- Inventory applications and forks that embed signalapp/ringrtc and rebuild them against v2.72.0 or later
- Monitor for unexpected microphone/camera indicator activity after calls end on managed endpoints
CVEs associated with Signal RingRTC Vulnerability (CVE-2026-113380) Can Keep
Weaknesses (CWE) in Signal RingRTC Vulnerability (CVE-2026-113380) Can Keep
Timeline of Signal RingRTC Vulnerability (CVE-2026-113380) Can Keep
- RingRTC 2.72.0 (v2.71.0...v2.72.0) contains the fix for FSM event-queue saturation blocking call hang-up
- RingRTC commit 4b1b6fa 'Ensure calls terminate completely in corner cases' authored by jim-signal, adding terminate_requested flag, 5-second TERMINATE_TIMEOUT and regression tests
- Third-party analysis notes with a synthetic offline Python PoC for the queue-blocking pattern published on GitHub (Imahian/Notes)
- CVE-2026-113380 published (MITRE/NVD) with CVSS v4.0 base score 9.3 and CWE-754
- Threadlinqs tracks CVE-2026-113380 as TL-2026-4117; no in-the-wild exploitation or threat actor reported
- GBHackers reports the vulnerability can keep the microphone active after users hang up
Sources cited for Signal RingRTC Vulnerability (CVE-2026-113380) Can Keep
- Signal Vulnerability Could Keep Microphone Active Even After Users Hang Up
- NVD - CVE-2026-113380
- RingRTC fix commit: Ensure calls terminate completely in corner cases
- RingRTC v2.71.0...v2.72.0 comparison
- CVE-2026-113380 analysis notes and synthetic PoC (Imahian/Notes)
- signalapp/ringrtc repository
- NVD CVE API record for CVE-2026-113380
Detection coverage for TL-2026-4117
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4117 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.