A flaw in Signal’s calling library could allow a call to remain connected after users believe the conversation has ended, potentially leaving audio and video streams active without indication. The vulnerability, identified as CVE-2026-113380, affects Signal’s open-source RingRTC library in versions prior to 2.72.0. MITRE assigned a CVSS score of 9.3, classifying it as critical. The issue stems from improper handling of events in RingRTC’s finite state machine, which manages call lifecycle operations. If the event queue becomes saturated with requests, the system may fail to process a hangup command, preventing the call from terminating cleanly. The flaw is categorized under CWE-754, which addresses inadequate validation of exceptional conditions. A proof-of-concept demonstration using a Python script illustrates how flooding the event queue can block termination requests. While CISA has not confirmed active exploitation, the vulnerability remains unpatched for earlier versions. Signal released version 2.72.0 last month, which introduces changes to allow the finite state machine to detect termination requests independently of the event queue and adds a timeout mechanism to prevent indefinite blocking. The update has been incorporated into Signal Desktop, though rollout timelines for Android, iOS, and other platforms are not fully documented. Users are advised to ensure their applications are updated to the latest version to mitigate the risk. The incident underscores the importance of timely software updates in maintaining secure communications, particularly for encrypted messaging platforms handling sensitive conversations.