The problem was in how RingRTC handled ending a call. A hang-up was treated as just another event in the call's Finite State Machine (FSM) event queue, with no priority and no rate limit on events from the other party. A remote peer could therefore flood the queue with junk, leaving the hang-up waiting behind attacker noise forever. "Flood the queue with junk and the hang-up waits behind attacker noise forever, so the call (microphone, possibly camera) is never torn down," a researcher's GitHub write-up explains.

The practical upshot: an attacker could keep audio and video tracks flowing from a target device while the victim believed the call was over. Signal fixed the issue in RingRTC version 2.72.0, released on 4 September, by ensuring call termination requests are detected independently and cannot stay blocked in the FSM event queue. Details and a proof-of-concept were published on Tuesday, the same day NIST added the CVE to its NVD database.

Users should update their Signal apps as soon as possible. Until then, the advice is to check the call indicator to confirm a call has genuinely ended.