Signal’ning RingRTC qo'ng'iroq kutubxonasidagi jiddiy zaiflik zararli qo'ng'iroq ishtirokchisiga boshqa foydalanuvchi qo'ng'iroqni tugatishga uringandan keyin ham audio qabul qilishni davom ettirishga imkon berishi mumkin.
CVE-2026-113380 sifatida kuzatiladigan bu zaiflik RingRTC’ning 2.72.0 dan oldingi versiyalariga ta'sir qiladi va CVSS v4.0 bo'yicha 9.3 ballga ega. Video treklar ham faol qolishi mumkin bo'lsa-da, rasmiy zaiflik tavsifida bu imkoniyat tasdiqlanmagan.
MITRE 2026-yil 20-oktabrda bu zaiflik haqida ma'lumot e'lon qildi va uni CWE-754: G'ayritabiiy yoki istisno sharoitlar uchun noto'g'ri tekshiruv sifatida tasnifladi.
RingRTC Signal’ning mobil va ish stoli ilovalari uchun qo'ng'iroq komponentlarini taqdim etadi, shuning uchun ishonchli qo'ng'iroq tugatish muhim maxfiylik masalasi hisoblanadi.
Zaiflik qo'ng'iroq va ulanish holatlaridagi o'zgarishlarni muvofiqlashtiradigan chekli holat mashinalari (FSM) bilan bog'liq. Ushbu FSM’lar 256 ta yozuvni sig'dira oladigan cheklangan hodisalar navbatiga ega. Masofaviy ishtirokchi qo'ng'iroq navbatini to'ldirib, boshqa ishtirokchi tugatish tugmasini bosganda mahalliy o'chirish jarayonini buzishi mumkin.
Yamoq tahlili shuni ko'rsatadiki, avvalgi tugatish ketma-ketligi operatsiya muvaffaqiyatsiz bo'lsa, erta to'xtashi mumkin edi. To'liq navbat tugatish hodisasini yuborishni oldini olishi mumkin, ilova bildirishnomalarining muvaffaqiyatsizligi kabi boshqa xatolar esa keyingi tozalashni to'xtatishi mumkin. Natijada, asosiy ulanish va media treklar to'liq yo'q qilinmasligi mumkin.
Bu muammo cheksiz o'sib boradigan navbatdan ko'ra aniqroq: navbatlar cheklangan va istisno sharoitlar o'chirishni yakunlashga to'sqinlik qilishi mumkin.
Imahian ma'lumotiga ko'ra, hujum ssenariysi qo'ng'iroqdagi zararli ishtirokchini o'z ichiga oladi, aloqa passiv kuzatuvchisi emas.
Bu zaiflikdan muvaffaqiyatli foydalanish jabrlanuvchi aloqa tugagan deb o'ylaganidan keyin sodir bo'ladigan suhbatlarni fosh qilishi mumkin. Biroq, mavjud texnik tavsifda ta'sirlangan mijozlar nima ko'rsatishi yoki muvaffaqiyatsiz tugatish paytida video qanday harakat qilishi aniq ko'rsatilmagan.
Bu muammoni tuzatish o'zgarishi Signal dasturchisi “jim-signal” tomonidan 2026-yil 4-sentabrda mualliflik qilingan. RingRTC 2.72.0 versiyasida chiqarilgan tuzatish holat mashinalari navbatdagi hodisalardan mustaqil ravishda tekshiradigan alohida tugatish bayrog'ini joriy qiladi.
Yamoq shuningdek, FSM o'chirish kutishlariga besh soniyalik cheklovlar qo'yadi va tugatish operatsiyalari muvaffaqiyatsiz bo'lganda ham tozalashni davom ettirishga ruxsat beradi. Regressiya testlari to'ldirilgan navbatlar va bildirishnoma xatolarini simulyatsiya qiladi, tugatish tugmasi bosilganda simulyatsiya qilingan tengdosh ulanishi yopilishi, chiquvchi audio o'chirilishi va uning RTP paket manbai tozalanishini ta'minlaydi.
Foydalanuvchilar Signal’ning so'nggi yangilanishlarini o'rnatishlari kerak. RingRTC’ni o'z ichiga olgan dasturchilar 2.72.0 yoki undan yuqori versiyaga yangilanishlari lozim. Kutubxona versiyasi ta'sirlangan versiyalar diapazonini belgilaydi; keltirilgan hisobotda aniq ta'sirlangan ilova relizlari tasdiqlanmagan, shuning uchun individual mijoz ta'sirini baholashda platforma bo'yicha umumiy xulosalar chiqarishdan qochish kerak.
A critical vulnerability in Signal’s RingRTC calling library could let a malicious call participant keep receiving audio after another user tries to hang up.
This vulnerability, tracked as CVE-2026-113380, affects versions of RingRTC before 2.72.0 and carries a CVSS v4.0 score of 9.3. While video tracks could also remain active, the official vulnerability description does not qualify this possibility.
MITRE published details about this vulnerability on October 20, 2026, classifying it as CWE-754: Improper Check for Unusual or Exceptional Conditions.
RingRTC provides calling components for both Signal’s mobile and desktop applications, making reliable call termination a significant privacy concern.
The vulnerability involves finite-state machines (FSMs) that coordinate changes in call and connection states. These FSMs have bounded event queues that can accommodate 256 entries. A remote participant can saturate a call’s queue, disrupting the local shutdown process when the other participant presses the hang-up button.
Patch analysis suggests that the prior termination sequence could stop prematurely if an operation failed. A full queue could prevent submission of a termination event, while other failures, such as unsuccessful application notifications, could interrupt subsequent cleanup. As a result, the underlying connection and media tracks might not be completely dismantled.
This issue is more specific than an endlessly growing backlog: the queues are bounded, and exceptional conditions can hinder shutdown completion.
According to Imahian, the attack scenario involves a malicious participant in a call, not an unrelated observer passively intercepting communications.
Successful exploitation of this vulnerability could expose conversations that occur after the victim believes the communication has ended. However, the technical description available does not specify what affected clients display or how video behaves during an unsuccessful teardown.
The corrective change for this issue was authored by Signal developer “jim-signal” on September 4. Released in RingRTC version 2.72.0, the fix introduces a separate termination flag that state machines check independently of queued events.
The patch also imposes five-second limits on FSM shutdown waits and allows cleanup to proceed even when termination operations fail. Regression tests simulate saturated queues and notification failures, ensuring that a hang-up closes the simulated peer connection, disables outgoing audio, and clears its RTP packet sink.
Users should install the latest Signal updates. Developers embedding RingRTC should upgrade to version 2.72.0 or later. The library version defines the range of affected versions; the cited reporting did not confirm specific impacted application releases, so avoid making platform-wide assumptions when assessing individual client exposure.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.