# Signal RingRTC Vulnerability (CVE-2026-113380) Can Keep Microphone Audio Active After Call Hang-Up

> A flaw in Signal's RingRTC calling library lets a malicious call participant keep receiving a victim's audio (and possibly video) after the victim hangs up, by saturating the bounded 256-entry event queue of the call finite-state machine so the local hang-up event is never processed. Fixed in RingRTC 2.72.0.

- **Published:** 2026-10-22T06:19:24Z
- **Last reviewed:** 2026-10-22T06:19:24Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4117
- **ID:** TL-2026-4117
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-113380

## Description

CVE-2026-113380 is an improper check for unusual or exceptional conditions (CWE-754) in RingRTC, the calling library used by Signal's Android, iOS and Desktop clients. Each call is managed by finite-state machines (FSMs) that consume events from bounded queues of 256 entries. A local hang-up is not a kill switch: it is one more event placed at the back of the call's FSM event queue. Because there is no rate limit on peer-originated events and no priority lane for hang-up, a remote call participant can flood the queue with peer-originated events so the termination event is never processed.

The result is that the victim presses hang-up and believes the call has ended, while the local audio track (and possibly the video track) remains up and continues to flow to the malicious peer. NVD describes the issue as a peer saturating the call's FSM queue, which can interfere with the ability of a local hangup to tear the call down. The attacker must be an active call participant; passive observers cannot exploit it. NVD scores it CVSS v4.0 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:N/SA:N).

Additionally, the prior termination sequence could stop prematurely if an operation failed, and unsuccessful application notifications could interrupt subsequent cleanup. The fix (commit 4b1b6fa, 'Ensure calls terminate completely in corner cases', author jim-signal, authored 2026-09-04, shipped in RingRTC 2.72.0) adds an atomic terminate_requested flag independent of queue depth, a terminate_if_requested() check after each event, a 5-second TERMINATE_TIMEOUT (wait_timeout_while) on FSM shutdown waits, cleanup that continues despite failed termination operations, and regression tests (inject_pause, wait_for_fsm_terminated) simulating queue saturation and notification failures.

A third-party analysis (Imahian/Notes) includes a synthetic offline Python PoC that demonstrates the queue-blocking pattern without real network calls. The sources report no named threat actor, no network IOCs and no confirmed in-the-wild exploitation. The exact on-the-wire signaling messages used to saturate the queue are not specified in the sources.

## MITRE ATT&CK

- T1123 Audio Capture
- T1125 Video Capture
- T1203 Exploitation for Client Execution

## Sources

- [Signal Vulnerability Could Keep Microphone Active Even After Users Hang Up](https://gbhackers.com/signal-vulnerability/)
- [NVD - CVE-2026-113380](https://nvd.nist.gov/vuln/detail/CVE-2026-113380)
- [RingRTC fix commit: Ensure calls terminate completely in corner cases](https://github.com/signalapp/ringrtc/commit/4b1b6fa53c9f30c87c8ea78e44675d4a13e1e4d3)
- [RingRTC v2.71.0...v2.72.0 comparison](https://github.com/signalapp/ringrtc/compare/v2.71.0...v2.72.0)
- [CVE-2026-113380 analysis notes and synthetic PoC (Imahian/Notes)](https://github.com/Imahian/Notes/tree/main/docs/CVEs/CVE-2026-113380)
- [signalapp/ringrtc repository](https://github.com/signalapp/ringrtc)
- [NVD CVE API record for CVE-2026-113380](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-113380)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4117