A critical vulnerability, identified as CVE-2026-113380, has been discovered in the Signal messenger. The flaw allows an attacker to maintain access to a victim's microphone or camera even after a call has been terminated. The vulnerability is rated 9.3 out of 10 on the CVSS scale.
The issue originates in the open-source RingRTC library, which is used for real-time audio and video transmission. It affects all versions of the library prior to 2.72.0. The exploit functions by triggering a denial-of-service attack on the event queue, preventing the connection termination command from being processed.
The vulnerability was patched in September 2026, with details publicly disclosed on October 20, 2026. While there is no evidence of the exploit being used in real-world attacks according to CISA, users are advised to update their applications to the latest version.
A 60-line proof-of-concept script written in Python is currently available on GitHub. The flaw is classified as CWE-754, stemming from improper handling of exceptional conditions within the event queue management mechanism.
