Signal calling flaw lets malicious participants prevent hang-ups

First reported by Cyber Security News at · Updated · 3 sources

The flaw affects Signal’s open-source RingRTC calling library and can prevent calls from ending properly. According to Cyber Security News, CVE-2026-113380 affects versions before 2.72.0, has a CVSS score of 9.3 and could let a malicious participant continue hearing audio after another user attempts to hang up.

Covered by 3 publishers within 10 hours of the first report.

Reporting3

Cyber Security News Critical Signal Vulnerability Could Keep Your Mic and Camera Live Even After Hang Up · Abinaya
SecurityWeek Signal Vulnerability Lets Malicious Callers Block Hang-Ups · Ionut Arghire
Security Affairs Signal Vulnerability Could Keep Calls Alive After Users Hang Up · Pierluigi Paganini