Signal App Vulnerability Disclosed with September Fix

A critical vulnerability (CVE-2026-113380) in Signal's RingRTC calling library, rated CVSS 9.3, has been revealed. This flaw could allow a malicious caller to prevent a call from properly ending, potentially keeping audio and video active after a user hangs up. A fix for this issue was released on September 4, 2026, meaning users who updated their app since then are likely protected.