Signal's open-source RingRTC bug kept mic, camera active after hangup

A critical bug in Signal's open-source RingRTC calling library, fixed in version 2.72.0, allows an attacker to flood the finite state machine event queue with requests, preventing hangup processing. The vulnerability affects all versions before 2.72.0 across Signal's mobile and desktop apps. Signal Desktop incorporated the fix in September, but exact rollout timing for other platforms remains unclear.

How the RingRTC hangup failure works

• Root cause: CWE-754 — improper checking for unusual or exceptional conditions in RingRTC's finite state machine event queue
• Attack vector: One party floods the FSM event queue with requests, causing a denial-of-service condition that prevents hangup request processing
• Impact: Call appears terminated to the user, but audio and/or video channels may remain active without indication
• Fix in RingRTC 2.72.0: FSM can detect termination requests independently of the event queue; timeout added to prevent indefinite blocking of hangup processing
• CVSS score: 9.3 (critical); attack complexity rated low
• Proof of concept: Python script demonstrating queue flooding available in GitHub report

Why it matters

The vulnerability highlights risks in complex state machines underlying real-time communication libraries widely used across the open-source ecosystem. Signal's open-source RingRTC, built on WebRTC, allows public audit of both the bug and its fix.