The CVE Program, in a record from MITRE, said RingRTC, the calling library inside Signal, has a flaw in versions before 2.72.0. Help Net Security said the record went public on 20 October 2026, rated 9.3 under CVSS 4.0. Researcher Imahian traced the cause. A hang-up is just one more task in the call's waiting line, and the other person can add tasks to that line too. RingRTC set no rate limit and gave hang-up no priority. An attacker who floods the line can leave the user believing the call ended while audio, and possibly video, still flows to the attacker.
Help Net Security said no attacks in the wild are known. It added that CISA's exploited-bug list does not include the flaw, and the National Vulnerability Database has not yet analysed it. The proof of concept is conceptual, and further detail is thin. The sources do not say whether video is affected, only that it may be. Imahian wrote that Android, iOS and Desktop clients stay exposed until each ships the fix. Which app releases already have it is not stated.
The flaw is a trust problem in the design: the user's own hang-up shared a line that the remote party could fill. Leaders who ship calling features can ask which products embed RingRTC, how they track the embedded version, and how they would confirm a client picked up 2.72.0.