Signal's hang-up button waited in the same queue as everything else, so a caller who flooded it could keep your audio streaming (CVE-2026-113380)
In RingRTC before 2.72.0, a local hang-up was one more event at the back of the call's queue. A peer who kept that queue full could stall the teardown. Signal's fix ends calls out of band, with a five-second deadline.
The researcher who goes by Imahian on GitHub put the bug in one line: “A local hang-up is not a kill switch: it is just one more event placed at the back of the call’s finite-state-machine event queue.”
Every call in RingRTC runs as a state machine fed by a queue of events: media changes, signaling from the other side, your own button presses. The advisory found two gaps that add up. “There is no rate limit on peer-originated events and no priority lane for hang-up.” A peer on the call sends events faster than the queue drains, and your hang-up waits its turn behind them, with the microphone still open.
The CVE record, assigned by MITRE on October 20, words it carefully: a peer that saturates the queue “can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.” It scores 9.3 under CVSS 4.0, with user interaction required, which here means you were on a call with the attacker. CISA’s own assessment marks it as not exploited and not automatable.
The Register asked Signal about it and didn’t hear back.
The code answers instead. The fix commit, titled “Ensure calls terminate completely in corner cases,” doesn’t build the priority lane the advisory sketched. It adds a flag, terminate_requested, that the call checks before it touches the queue, with a comment that says what it’s for: “Terminate out of band, independent of queue depth.” Then a deadline, TERMINATE_TIMEOUT, set to five seconds: “How long to wait for an FSM to quiesce before tearing down anyway.” The queue it bypasses holds at most 256 events.
The commit is dated September 4, the same day 2.72.0 was tagged. The CVE request came weeks after the fix shipped, and the record cites only the advisory. How long the hole was open before that, and whether anyone on a real call ever leaned on it, neither the commit nor the record says.
Signal’s reputation rests on not leaking what you say, and almost all the attention goes to the encryption. This bug had nothing to do with encryption. Every byte stayed end-to-end encrypted the whole time, delivered faithfully to the person you thought you’d stopped talking to.
That’s the part worth carrying to other code. Cancellation tends to get written as one more message, because messages are how everything else in the system already works. It holds up fine until someone on the other end has a reason to keep the line busy.