In an era where digital privacy is the cornerstone of secure communication, the discovery of a significant vulnerability in the Signal messaging app has sent shockwaves through the cybersecurity community. Signal, widely regarded as the gold standard for encrypted communication, recently faced a serious challenge to its reputation for total privacy. A newly disclosed flaw, tracked as CVE-2026-113380, has been identified within the app’s underlying calling library, RingRTC. This vulnerability creates a "ghost call" scenario, potentially allowing an attacker to continue eavesdropping on a victim’s audio and video streams even after the victim has ostensibly terminated the call.

The discovery serves as a sobering reminder that even the most robust end-to-end encryption protocols are only as strong as the software architecture that facilitates the call. As Signal users globally rely on the platform for sensitive, private, and professional conversations, understanding the mechanics of this flaw—and the urgency of patching it—is paramount.

The Core Vulnerability: How CVE-2026-113380 Works

At the heart of the issue is RingRTC, the open-source library that powers voice and video calls within the Signal ecosystem. RingRTC is built upon WebRTC, the industry-standard technology that enables real-time, peer-to-peer audio and video communication across browsers and mobile applications.

The Mechanics of the "Hang-up" Failure

The vulnerability, assigned a high CVSS 4.0 score of 9.3, centers on the Finite State Machine (FSM) event queue that manages the lifecycle of a call. Under normal circumstances, when a user taps the "hang-up" button, the application sends a signal to the FSM to terminate the connection and close the media streams.

However, security researcher "Imahian," who first documented the flaw, discovered that this termination request is treated as just another event in a queue. The vulnerability arises because RingRTC failed to implement a "priority lane" for termination signals. By flooding the call’s event queue with a barrage of junk data, a malicious caller can effectively bury the user’s "hang-up" event behind a backlog of irrelevant traffic.

Because the library lacks rate-limiting for peer-originated events, the attacker can force the application to remain in an "active" state indefinitely. To the victim, the interface appears as though the call has ended, but the underlying media streams remain open, allowing the attacker to continue receiving audio—and potentially video—from the victim’s device without their knowledge.

Chronology of Discovery and Disclosure

The timeline of this vulnerability reflects the rigorous, yet sometimes slow, process of modern coordinated vulnerability disclosure.

• Initial Discovery: The researcher known as Imahian identified the flaw while conducting a deep-dive analysis of the RingRTC codebase. Recognizing the severe privacy implications, the findings were meticulously documented.
• The Technical Write-up: On October 20, 2026, the vulnerability was officially assigned the identifier CVE-2026-113380 by MITRE. This date marked the formal entry of the flaw into the global vulnerability database.
• Public Awareness: Shortly after the CVE publication, Imahian released a comprehensive technical breakdown on GitHub. This release included a conceptual proof-of-concept (PoC) demonstrating how a malicious actor could artificially delay a call’s teardown.
• Patch Deployment: Signal’s engineering team moved to address the oversight by implementing a fix within the RingRTC library, version 2.72.0. This update introduced the necessary priority handling to ensure that "hang-up" events bypass the standard event queue, regardless of network traffic congestion or malicious interference.

Supporting Data: Impact and Risk Assessment

The CVSS (Common Vulnerability Scoring System) score of 9.3 highlights the gravity of this flaw. This rating is broken down into several critical factors that define the risk profile:

Technical Risk Factors

• Attack Vector: Network-based. The attacker does not need physical access to the device; they only need to be in an active call with the victim.
• Complexity: Low. The exploit does not require highly sophisticated hacking tools; it primarily requires an understanding of the RingRTC event queue and the ability to automate event flooding.
• Privileges Required: None. An attacker can initiate this exploit as a standard user, making it accessible to anyone with the ability to place a call.
• Confidentiality and Integrity: High impact. The unauthorized capture of audio and video constitutes a total breach of user confidentiality and a severe violation of the "expected state" of the software.

The Scope of Exposure

The vulnerability is platform-agnostic, affecting every Signal client—including Android, iOS, and Desktop versions—that relies on a RingRTC build older than 2.72.0. Because Signal is used across millions of devices, the potential "attack surface" was, until the patch, global and extensive.

Official Responses and Industry Standing

Signal’s response has been consistent with its commitment to security. By releasing the patch in version 2.72.0 and linking to the specific GitHub commit, the organization demonstrated transparency. However, the broader security landscape remains cautious.

The Role of CISA and the NVD

As of late 2026, the Cybersecurity and Infrastructure Security Agency (CISA) has not yet added CVE-2026-113380 to its "Known Exploited Vulnerabilities" (KEV) catalog. This is largely because there are currently no confirmed reports of the vulnerability being leveraged in the wild against high-value targets or the general public. Furthermore, the National Vulnerability Database (NVD) continues to list the item as "awaiting analysis," a standard status for new, high-impact entries that require independent verification by federal analysts.

Researcher Perspectives

Imahian’s write-up underscores the danger of trusting remote peers in real-time communication systems. The core issue, as the researcher noted, was a failure to apply "Zero Trust" principles to the event queue. By treating all events—whether from the local user or the remote peer—as equally valid, the system created a "denial of service" attack against its own security features.

Implications for Privacy-Focused Communication

The Signal "ghost call" vulnerability has broader implications for the future of encrypted messaging and real-time communication apps.

The Fragility of Complexity

Real-time media libraries like WebRTC and RingRTC are incredibly complex pieces of software. They must manage synchronization, jitter, packet loss, and state transitions in milliseconds. The CVE-2026-113380 incident proves that even when the encryption (the lock on the door) is perfect, the management (the latch on the door) can be exploited if it is not designed with adversarial conditions in mind.

The Responsibility of the End-User

While Signal’s developers are responsible for writing secure code, the end-user plays a critical role in the maintenance of that security. The existence of this vulnerability reinforces the necessity of "Automatic Updates." In a digital landscape where vulnerabilities are identified daily, keeping applications updated is not merely a feature-seeking activity—it is a defensive security requirement.

Future Safeguards

The industry is likely to see a shift in how FSM queues are implemented in messaging apps. Future iterations of calling libraries will likely incorporate:

1. Strict Priority Lanes: Ensuring that control signals (like disconnects) are handled by a dedicated, protected thread that cannot be blocked by media data.
2. Rate Limiting: Implementing aggressive throttling for any peer-originated event that attempts to flood the local state machine.
3. Heartbeat Validation: Implementing a secondary "dead-man’s switch" that monitors the connection health from the OS level, rather than relying solely on the application-level event queue.

Conclusion: Lessons Learned

The discovery of CVE-2026-113380 is a stark reminder that digital privacy is a dynamic, ongoing process rather than a static state. Signal remains one of the most secure platforms available, and its rapid response to this vulnerability reaffirms its dedication to its user base.

However, users must remain vigilant. The "ghost call" flaw shows that vulnerabilities can hide in the most mundane parts of an application—in this case, the event queue that manages the end of a conversation. For the average user, the takeaway is simple: check your app stores, ensure auto-update is enabled, and remain aware that even in the safest digital spaces, technical flaws can occur.

As we move further into an age of hyper-connectivity, the burden of security is shared between the developers who build our tools and the users who operate them. By keeping software up-to-date and staying informed about reported vulnerabilities, the community can force developers to maintain the highest standards, ensuring that private conversations remain exactly that—private.

The patching of RingRTC 2.72.0 effectively closes this specific door, but it stands as a cautionary tale for the next generation of real-time communication software. As researchers like Imahian continue to stress-test these vital tools, the entire industry benefits, ultimately leading to a more secure and resilient internet for everyone.