请务必在通过 Signal 挂断电话后，不要说任何刻薄或机密的话，因为这款加密通讯应用的通话库中存在一个漏洞，可能导致通话无法正常结束，从而让音频甚至视频保持开启状态。
Make sure you don’t say anything mean or secret after hanging up a call on Signal, as a bug in the encrypted messaging app’s calling library could prevent a call from ending properly, potentially leaving audio and possibly video active.
该漏洞编号为 CVE-2026-113380，由 MITRE 于周二发布，CVSS 评分为 9.3，属于严重级别，影响 Signal 开源的 RingRTC 库 2.72.0 版本之前的所有版本。该更新已于上月推出，但漏洞详情直到现在才公开。RingRTC 是 Signal 自行开发的通话库，构建于 WebRTC 之上，WebRTC 是一项 2011 年推出、此后广泛用于互联网语音和视频通信的技术。
The vulnerability, CVE-2026-113380, was published by MITRE on Tuesday and given a CVSS score of 9.3, marking it as a critical issue in Signal’s open-source RingRTC library in every single version before 2.72.0. That update was pushed out last month, but the vulnerability wasn’t made public until now. RingRTC is Signal’s own calling library built on top of WebRTC, a technology introduced in 2011 that has since become widely used for voice and video communication over the internet.
RingRTC 利用 WebRTC 提供 Signal 专用的通话功能，WebRTC 本身已对媒体流量进行加密，但据 CVE 报告称，这并未阻止 RingRTC 在特定条件下无法挂断通话。
RingRTC provides Signal-specific calling functionality using WebRTC, which already encrypts media traffic, but that isn't stopping RingRTC from failing to hang up calls in certain conditions, according to the CVE report.
从本质上讲，这是一种针对 RingRTC 有限状态机（FSM）事件队列的拒绝服务攻击，该队列负责处理通话管理相关的事件。如果通话一方向 FSM 队列发送大量请求使其饱和，队列可能会不堪重负，无法处理挂断请求，从而导致通话无法正常终止。根据 GitHub 上发布的报告，该漏洞被归类为 CWE-754，即对异常或特殊条件检查不当。
What’s happening is, in essence, a denial-of-service attack on RingRTC’s finite state machine (FSM) event queue, which handles events involved in managing calls. If one of the people on the call saturates the FSM queue with requests, it can become overwhelmed and fail to process a hangup request, preventing the call from terminating properly. The vulnerability is classified as CWE-754, or improper checking for unusual or exceptional conditions, according to a report posted to GitHub.
GitHub 报告中提供了一个概念验证，使用 Python 脚本模拟了事件队列被淹没如何阻止挂断请求被处理。如果恶意行为者利用此漏洞，另一方可能以为通话已结束，但其视频和音频通道中的一个或两个可能仍处于开启状态。
A conceptual proof of concept is available in the GitHub report linked above, using a Python script to simulate how flooding an event queue can prevent a hangup request from being processed. Were a malicious actor to exploit this, the person on the other end may think the call has been terminated, but either or both of their video and audio channels could still be open.
根据 CVE 评定，该漏洞的攻击复杂度被认为较低，虽然 CISA 的已知被利用漏洞目录并未显示该漏洞已在野外被发现，但 Signal 用户应确保其移动端和桌面端应用均已更新至最新版本，以免在毫不知情的情况下陷入“热麦克风”状态。对比 RingRTC 2.72.0 与上一版本显示，Signal 的修复允许通话的有限状态机（FSM）独立于事件队列检测终止请求，并增加了超时机制，以防止处理停滞无限期阻挂断操作。
The attack complexity is considered low according to the CVE, and while CISA’s known exploited vulnerabilities catalog doesn’t indicate this has been spotted in the wild, Signal users ought to ensure they’ve updated their apps - mobile and desktop - to the latest versions to ensure they don’t end up being caught on a hot mic without any notice. Comparing RingRTC 2.72.0 to the previous version indicates that Signal's fix allows the call's finite state machine (FSM) to detect termination requests independently of the event queue, while adding a timeout to prevent stalled processing from indefinitely blocking a hangup.
从 Signal 的发行说明来看，修复版 RingRTC 何时到达其 Android、iOS 和桌面版应用并不完全清楚。Signal Desktop 的发布历史表明，RingRTC 2.72.0 于 9 月被纳入，但各平台的确切推出日期仍不清楚。我们已联系 Signal 以了解更多情况，但尚未收到回复。在此期间，最好更新您的安装版本，以确保不再处于易受攻击状态。此外，挂断通话后也要注意自己说的话。®
It's not entirely clear from Signal's release notes when the fixed version of RingRTC reached the Android, iOS, and desktop versions of its apps. Signal Desktop's release history indicates that RingRTC 2.72.0 was incorporated in September, but the precise rollout dates across all platforms remain unclear. We’ve reached out to Signal to learn more, but haven’t heard back. In the meantime, best to update your installation to be sure you’re not still vulnerable. That, and watch what you say after hanging up a call. ®