🚨Signal's RingRTC Bug Leaves Calls on Hot Mic
Signal's Calling Library Has a Critical Bug
TL;DR
Signal's RingRTC library has a critical bug (CVE-2026-113380) that prevents calls from ending properly. Users must update to version 2.72.0 to avoid potential privacy issues.
Signal's RingRTC library, used for calls, has a critical bug (CVE-2026-113380) that can leave calls active indefinitely. This affects all versions before 2.72.0, with a CVSS score of 9.3. The bug, classified as CWE-754, can be exploited with a low complexity attack, potentially exposing users to privacy risks. Signal released an update last month, but precise rollout dates are unclear. Users should update their apps to ensure calls end properly and prevent sensitive conversations from being inadvertently shared.
Key Points
CVE-2026-113380 affects all RingRTC versions before 2.72.0, CVSS score 9.3
RingRTC is Signal's calling library built on WebRTC, providing Signal-specific functionality
Attack complexity is low, making exploitation feasible with minimal effort
Signal released a fix last month, but rollout dates across platforms are unclear
Update to RingRTC 2.72.0 to ensure calls end properly and prevent privacy leaks
Why It Matters
If you're using Signal for sensitive communications, this update is critical. The bug can leave calls active indefinitely, potentially exposing sensitive conversations. Ensure your app is updated to 2.72.0 to avoid privacy risks.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,569 builders reading daily.