Ringrtc
Monthly
Call teardown in Signal's RingRTC media library is unreliable before version 2.72.0: a peer that floods the call's finite-state-machine event channel can prevent a locally initiated hangup from actually tearing down the call, leaving the audio track - and potentially the video track - live after the user believes the call has ended. The attacker must already be an accepted participant in the call (the CVSS 4.0 vector is PR:N, i.e. no privileges required, though call participation is a practical prerequisite) and the victim must actively hang up (UI:P) for the impact to occur, which is why the upstream score of 9.3 is tempered by these preconditions. No public exploit code and no active exploitation have been identified at time of analysis; the realistic threat is a malicious or compromised call peer deliberately saturating the queue so the microphone stays open.
Call teardown in Signal's RingRTC media library is unreliable before version 2.72.0: a peer that floods the call's finite-state-machine event channel can prevent a locally initiated hangup from actually tearing down the call, leaving the audio track - and potentially the video track - live after the user believes the call has ended. The attacker must already be an accepted participant in the call (the CVSS 4.0 vector is PR:N, i.e. no privileges required, though call participation is a practical prerequisite) and the victim must actively hang up (UI:P) for the impact to occur, which is why the upstream score of 9.3 is tempered by these preconditions. No public exploit code and no active exploitation have been identified at time of analysis; the realistic threat is a malicious or compromised call peer deliberately saturating the queue so the microphone stays open.