Cyberinsider Signal Fixes Critical Flaw Allowing Eavesdropping After Call Hangup
Article Content
- •CVE-2026-113380 has a CVSS score of 9.3, indicating critical severity.
- •The vulnerability allows eavesdropping by preventing proper call termination.
- •Users should update to RingRTC version 2.72.0 or later to mitigate the risk.
Signal has patched a critical vulnerability in its RingRTC calling library, tracked as CVE-2026-113380, which could allow a malicious participant to continue hearing audio after a call has ended. The flaw affects versions prior to 2.72.0 and has a CVSS score of 9.3. It involves the library's finite state machine queue, which can be overwhelmed, preventing proper call termination. While the vulnerability does not compromise encryption, it poses a significant privacy risk. No known exploitation has been reported in the wild. Users are advised to update to the latest version of the Signal app to mitigate this risk. The patch was included in RingRTC version 2.72.0, released on September 4, 2026.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (7)
Following this threat?
Track Signal and CVE-2026-113380 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which versions of Signal are affected?
Is this vulnerability being actively exploited?
What should users do to protect themselves?
Continue Reading
Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…