Why it is trending
CVE-2026-113380
In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.
- CVSS 9.3
- Buzz
- 25discussion, 0-100
- Danger
- 20exploitability, 0-100
- Mentions
- 6since 22 Oct 2026
- EPSS
- 0.3%exploit probability
- X4 mentions · 4 voices
- Dark web2 mentions · count only
Out of 6 mentions in total. We show how many, never what was said or where.
X
A reported Signal flaw could blur the line between hang-up and privacy. Security Affairs cites CVE-2026-113380 and CVSS 9.3; Signal has not confirmed the details. Check official updates and verify mic or camera indicators after calls. Get the brief → https://t.co/2bfSD5Ewgl https://t.co/TMA1Ta5dnH
🚨 CRITICAL SIGNAL SECURITY FLAW: YOUR MICROPHONE COULD KEEP TRANSMITTING EVEN AFTER YOU HANG UP! A newly disclosed vulnerability in #Signal, one of the world's best-known encrypted messaging apps, could allow a malicious call participant to prevent a voice or video call from properly ending. Imagin…
SANS Stormcast Friday, October 23rd, 2026: PHP2Shell Exploitation Update; Signal Call Hang-Up Flaw (CVE-2026-113380); Cisco Snort 3 Critical Vulnerabilities; Linux KSMBD RCE Reports Leaked https://t.co/03fbCidRZE https://t.co/PwLmDFvKyC
SIGNAL HAD A BUG THAT COULD KEEP UR MIC LIVE AFTER U HANG UP CVE-2026-113380, ringrtc before 2.72.0. the other party on a call ur already in floods the call fsm queue (256 slots) and ur hangup just waits in line behind their junk. the cve says audio, video only "perhaps" not zero-click, it needs so…
No public proof-of-concept links on record.
Links are collected from public posts and are not reviewed by Brandefense. Exploit code can be unsafe or malicious: only study it in an isolated lab, and never run it against systems you do not own.
Get a morning brief and an alert the moment a critical vulnerability like this one starts trending.
Subscribe