Signal vulnerability lets malicious callers block hang-ups

Signal resolved a critical-severity vulnerability, CVE-2026-113380, that could allow a malicious caller to keep audio and video tracks enabled after a user hung up. The vulnerability affects RingRTC, Signal’s open source library for voice and video calls.