Signal bug could keep your mic - and camera - on after hangup
A critical security flaw in Signal's open-source RingRTC library affected all versions before 2.72.0, which was released last month. The vulnerability stems from improper handling of the finite state machine event queue that manages call events. If one participant floods the queue with requests, it can become overwhelmed and fail to process the hangup request, leaving the call active. The issue has a CVSS score of 9.3 and was publicly disclosed after the patch became available.
Key points
- Affects Signal RingRTC library versions before 2.72.0
- FSM queue overflow can prevent proper call termination
- Critical severity rated 9.3 CVSS
- Patch available but vulnerability disclosed after release
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The Register did the reporting; read the original for the full story.
Read the full story at The Register
