Critical Remote Call Termination Bypass in Signal’s RingRTC Library (CVE‑2026‑113380) Allows Persistent Mic/Camera Access
What It Is – A flaw in Signal’s RingRTC calling library (versions < 2.72.0) lets a malicious peer flood the call‑state event queue, delaying the local hang‑up operation. The victim’s microphone and, potentially, camera may remain active after the user believes the call has ended.
Exploitability – The vulnerability is rated CVSS 9.3 (Critical). No public exploit code is known, but the attack requires only a crafted call‑peer that can generate a high volume of events, which is feasible on any device running the vulnerable library.
Affected Products – Signal for Android < 8.27.0, Signal for iOS < 8.30.0, and any third‑party app embedding RingRTC < 2.72.0.
Why It Matters for Trust & Control Assurance
- Reliable session termination is a core control objective; failure erodes confidence that media devices are de‑activated on command.
- Continuous monitoring of endpoint controls (e.g., “media off on hang‑up”) provides audit‑ready evidence that the organization enforces the principle of least privilege.
- Demonstrable remediation (patch status, version inventory) satisfies multiple framework requirements with a single control evidence set.
Recommended Actions
- Verify the RingRTC version on all Signal deployments; upgrade to 2.72.0 or later immediately.
- Deploy an inventory check and automated compliance rule that flags any device still running a vulnerable version.
- Incorporate “call termination latency” into your endpoint monitoring dashboards to detect abnormal queue‑blocking behavior.
- Document the remediation steps in your control evidence repository for audit readiness.
Source: Security Affairs – Signal Vulnerability (CVE‑2026‑113380)