DEV Community

Anoymask
Anoymask

Posted on

Signal RingRTC CVE-2026-113380: Queue Saturation Can Keep Audio and Possibly Video Active After Hang-Up

#security #threatintel

1. Basic Information

2. Executive Summary

A vulnerability in Signal's calling library, RingRTC, can disrupt hang-up processing if a call peer saturates the finite-state machine (FSM) event queue. Audio and, under some conditions, video capture and transmission may then continue after the user attempts to hang up. Note that the published proof-of-concept (PoC) code is a synthetic queue simulation in an offline environment and does not demonstrate successful attacks against live Signal calls on a real network.

3. Attack Flow

The attack path is based on the CVE record and fix commit (the PoC published by the researcher is a synthetic model that does not include network traffic or live calls, and must be clearly distinguished from the validation of exploit procedures in a real environment).

Attack Path Indicated by CVE Description

  1. An attacker establishes an active call with the target and sends a large volume of peer-derived events to the vulnerable RingRTC call event processing mechanism.
  2. Saturating the FSM event queue prevents hang-up processing locally on the victim's device from successfully completing the release of the call session and media tracks.
  3. Even after the user perceives the call as ended on the screen, the transmission of the audio track (and potentially the video track) continues (this is the technical impact of the published flaw, not an indication of actual damage in a real attack).

The table summarizes the public information above. Defender signals are suggestions for investigation in your own environment (Inference). Undisclosed implementation details and follow-on behavior are left unspecified.

Attack Stage Attacker Action / Technique Tools / Communication Used Defender Signals (Conditions / Artifacts)
1. Call Establishment Establishes a Signal call session with the target Signal call (E2EE WebRTC communication) Normal Signal call start logs and incoming call records
2. Queue Saturation Continuously sends a large volume of peer-derived events to saturate the RingRTC FSM queue Specific network message format undisclosed Device-side event records when available (the published model is not a reproduction of a live call)
3. Hang-Up Disruption The victim's local hang-up event stalls and processing is blocked within the queue Interference with normal hang-up operations Media sessions remain active even after the victim's disconnect action
4. Impact (Potential) Audio and potentially video may continue even after hang-up Potential continuation of media communication OS displays and encrypted traffic flows alone do not confirm content transmission or delivery to the peer

4. Attacker Position and Execution Location

  • A remote call peer who has established an active call with the victim.

5. Victim and Administrator Perspective

Victims

  • Even though the call appears to have been disconnected by pressing the end call button on the UI, an in-call indicator (such as an active microphone or camera light) may remain in the OS status bar, and audio may continue to reach the other party.

Administrators and SOCs

  • May be observed as active device privacy indicators, application log inconsistencies, lingering media sessions, or continued network traffic past the disconnection timestamp.

6. Success and Failure Conditions

Success Conditions

  • A Signal client incorporating RingRTC prior to version 2.72.0 is running.
  • The attacker is able to establish a call with the victim and saturate the FSM queue.

Failure Conditions and Mitigations

  • Immediately update the Signal app to the latest version containing the patched RingRTC.
  • Verify that the OS microphone and camera usage indicators (icons) turn off after ending a call, and if they do not disappear, completely force-close the application.

7. What Happens Upon Success

  • Unauthorized capture or eavesdropping on surrounding audio after the user attempts to hang up.
  • Unintended continuation of video track transmission under specific conditions.
  • Severe privacy breach and leakage of confidential information.

8. Observable Logs

Inference: The following are candidates for internal investigation. Availability depends on the product, privileges, settings, and retention periods, and should be distinguished from observation records in source materials. Single events alone do not confirm attribution or successful compromise in this case.

Email

  • This issue requires an established call, and email delivery vectors have not been publicized.

Proxy / SWG / DNS

  • Internal call FSM events or hang-up processing cannot be directly read from proxy or DNS logs. Correlate available destination IPs and session durations with device records.

Endpoint / EDR

  • Review available Signal app logs, OS microphone and camera access display histories, and correlate hang-up times with media session states (this issue involves a call processing flaw; OS shell execution or file generation are not inherent required indicators).

Identity / IdP

  • Verification of accounts and linked devices is performed to isolate alternative factors, but administrative privileges or authentication compromise are not required for the issue itself to manifest.

SaaS / Cloud

  • Check application versions and deployment histories collectible via MDM or management tools (Signal's E2EE communication contents and detailed FSM logs are not retained in cloud audit logs).

Network

  • Correlate the duration of media communication traffic continuing past the hang-up operation time with device-side records (due to encrypted communications, packet contents alone cannot reconstruct audio or video contents).

9. Attack Success Determination

Confirmed in Public Information

The CVE record and RingRTC fix commit substantiate the existence of a flaw that impedes hang-up processing. The fix commit includes unit tests in a synthetic environment. The researcher's PoC is also an offline queue model and is distinct from confirmation of successful exploitation or actual damage in live calls.

Internal Determination Criteria

  • User Operation Confirmed: The stage where call establishment and the user's hang-up operation are confirmed via device logs or similar means. Operation records alone cannot determine the success or failure of communication termination.
  • Information Theft or Session Compromise Confirmed: When factual evidence substantiates that audio or video continued to reach the peer as encrypted communication even after the hang-up operation (lingering OS displays or ongoing encrypted traffic flows alone do not confirm the transmission or delivery of audio/video contents).

10. Investigation Playbook

  • Trigger: Initiated by microphone indicators remaining lit after call termination, sessions with abnormally long durations, or suspicious ongoing traffic.
  • Initial Review: Check the Signal app version, included RingRTC version, call partner, hang-up operation time, and OS privacy indicator display state.
  • Endpoint / Server Investigation: Preserve Signal app logs, crash logs, OS media permission logs, and screen captures.
  • Identity / Cloud Investigation: Check the list of registered devices on the account and rule out suspicious linked devices or account takeover possibilities.
  • Subsequent Actions: Investigate call duration, outgoing data volume, and follow-up communications from the peer.
  • Containment: Force-close the application, update to the latest version, and temporarily disconnect the device from the network if necessary.
  • Judgment Classification: Clearly distinguish contact, execution, successful authentication, information retrieval, and subsequent compromise stages, and do not assume unverified success.

11. Defense and Detection Ideas

  • Single Events: Detect persistent lighting of media indicators after hang-up operations or abnormally long call sessions.
  • Temporal Correlation: Correlate the flow of a sudden surge in peer events -> hang-up operation -> remaining media sessions -> ongoing encrypted traffic.
  • Threat Hunting: Comprehensively search managed devices for Signal versions, abnormally long call records, and post-call traffic.
  • Log Limitations: Due to E2EE communication, network equipment cannot inspect payloads, and mobile OS telemetry regarding application internals is limited.
  • Priority Mitigations: Promptly update the Signal app, verify compliance with managed device versions, educate users on checking privacy indicators, and establish reporting procedures for anomalies.

12. Facts / Inference / Hypothesis

Facts

  • CVE-2026-113380 affects RingRTC prior to version 2.72.0 and has a severity score of CVSS v4.0 9.3.
  • The CVE record indicates that saturation of the FSM event queue by a call partner prevents local hang-up processing from completing, potentially causing audio or, in some cases, video to continue.
  • The fix commit is dated September 4, 2026, and introduces processing to evaluate termination requests independently of the queue, continuing media resource release even upon notification failure, alongside unit tests.
  • The PoC published by the researcher is an offline synthetic queue simulation and does not demonstrate successful exploitation in actual Signal calls. Additionally, referenced materials show no observations of active exploitation.

Inference

  • Because there is a divergence between operation completion on the device screen and the actual cessation of media tracks, safety cannot be judged based solely on UI displays.

Hypothesis

No additional hypotheses. Unverified items are listed in "Unknowns and Additional Investigation."

13. MITRE ATT&CK Mapping

The following are candidates based on the potential impact in desktop environments, and do not imply uniform applicability to mobile environments or confirmation of active exploitation.

ID Technique Confidence Basis
T1123 Audio Capture medium Candidate based on the impact when the audio track continues to be transmitted even after the hang-up operation (recording operations by the attacker and active exploitation are unconfirmed).
T1125 Video Capture low Candidate based on the CVE description that video tracks may also continue (specific success conditions and successful recording are unconfirmed).

14. Unknowns and Additional Investigation

  • The exact versions and dates when the patched RingRTC was incorporated into official releases of Signal clients for each OS (iOS, Android, Desktop).
  • Presence of active exploitation, stable detection signatures, and specific conditions for video continuation.

15. Impact on SOCs and Organizations

Organizations utilizing Signal for business communications or sensitive calls should immediately verify app versions on managed devices, update them to the latest version, and investigate device and network logs if anomalies are reported where OS microphone or camera indicators persist after call termination.

16. Audience-Specific Summary

  • For SOCs: Monitor and correlate ongoing media sessions after call termination operations, suspiciously long WebRTC traffic, and persistent OS privacy indicator lighting.
  • For Administrators: Immediately update the Signal app to the latest version and verify that no outdated builds (RingRTC prior to 2.72.0) remain across managed devices.
  • For Users: Update the Signal app to the latest version, and if microphone or camera icons on the screen do not disappear after ending a call, force-close the application and notify your administrator.

Top comments (0)