:quality(90):no_upscale()){kind=logo}
Calling Vunerability Illustrates Why Consumer-Grade Tools Do Not Suit Mission-Critical Communications
STATUS: Disclosed Vunerability, Patched SEVERITY: 4/10 AUDIENCE: Government, Defense, Critical Infrastructure Security Leads
Nov 5, 2026
·Blog
·Secure Communications
:quality(90):no_upscale())
A critical flaw in Signal's RingRTC calling library, CVE-2026-1133806 with a CVSS score of 9.3, let a malicious participant keep a call's audio, and possibly video, flowing after the victim hung up. Signal has fixed it and the flaw illustrates why consumer-grade tools do not suit mission-critical communications: the conditions it depended on, a participant the organization has not vetted and a client version the organization does not control, come from how consumer apps are designed and deployed and not from this one bug.
What Happened
Consumer calling tools are designed for users who trust the person they call and who update their own apps.
On October 20, MITRE published CVE-2026-1133806, a flaw in RingRTC, the open source library based on WebRTC that Signal uses for voice and video calls.1 A participant who floods a call's event queue can keep the other person's hang-up waiting, so audio, and possibly video, keeps reaching the attacker while the victim believes the call ended.2 The researcher who published the write-up notes that the library trusted the remote peer with that queue, with no rate limit and no priority lane for hang-up, and the shared library means every Signal client on Android, iOS, and desktop was affected.3
Signal fixed the flaw in RingRTC 2.72.0 by ensuring that call termination requests do not stay blocked in the event queue and are detected independently. The researcher's proof of concept is conceptual and the coverage reviewed reports no confirmed exploitation.1 The flaw concerns how calls end and leaves Signal's encryption intact.
Consumer-grade describes how a tool is designed and deployed and says nothing about the quality of its engineering. Signal is a free app for the general public and is well regarded for that purpose. Anyone can install it and enroll, who takes part in a conversation is each user's choice, the organization has no view of which software versions its staff run, and updating belongs to each user. Those properties suit personal communication. In this case, the attacker needed to be a participant on the call and needed the victim to be running an unpatched client.
Mission-critical communications are those where eavesdropping, loss, or unavailability has operational consequences, as in government, defense, and critical infrastructure. They require the organization, and not each individual user, to control who can take part, which software versions run, and what happens when something goes wrong. A live microphone after a call is an inconvenience for a private user and a security exposure for an official discussing operations.
Governments have reached a similar conclusion. After state-linked account takeovers of senior officials on messaging apps, the European Commission reportedly told a group of senior officials to leave a Signal chat over compromise concerns4 and an internal EU cyber presentation cited the lack of a standardized secure communications system as a structural problem.5
What It Means
Finding | What It Means | Operational Consequence | Open Question |
The flaw let a call participant keep audio live after the victim hung up and the calling library trusted the remote peer with the queue that handles hang-up. | Consumer calling stacks assume the other party on a call is acting in good faith. | Where a contact's account may be compromised or impersonated, a call participant cannot be treated as trusted. | Whether other consumer calling components make the same assumption about the remote participant? |
The flaw affects every Signal client through a shared library and updating is left to each user unless the device is managed. | An organization using a consumer app has no control over how quickly a fix reaches its staff. | Patch status for a tool used in sensitive conversations is unknown to the organization that depends on it. | How many staff use consumer calling apps for work and on which devices? |
Governments have acted on the same structural concern, with the European Commission reportedly telling senior officials to leave a Signal chat and an EU presentation citing the lack of a standardized secure communications system. | The limits of consumer tools for official use are already recognized at senior levels of government. | Informal use of consumer apps for official business leaves staff without a sanctioned alternative. | What a sanctioned alternative must offer to be adopted instead of quietly bypassed? |
Why This Matters
Old Assumption | Current Reality | BlackBerry Response |
A widely respected consumer app is good enough for sensitive operational calls. | Consumer-grade describes design intent and says nothing about engineering quality. Participation is each user's choice, the organization cannot control software versions, and it has no administrative visibility, which a mission-critical setting cannot accept however well the app is built. | BlackBerry® SecuSUITE® is built for organizations that need to administer participants, devices, and software, the controls consumer tools leave to the individual. |
A fast patch makes the risk go away. | A fix is only as good as its reach and an organization cannot see or enforce which devices have it unless it manages them. | BlackBerry® UEM can report app versions on managed devices and enforce minimum versions, so an organization can confirm a fix has reached its fleet. |
Encryption alone makes a call safe for mission-critical use. | The flaw left encryption intact while exposing a participant's live audio to the other party, so controls on who is on the call and the state of their device matter as much as the cipher. | BlackBerry SecuSUITE and BlackBerry UEM let an organization control who is on a call and the software state of the devices on it. |
Recommended Actions
IMMEDIATE | Update Signal on every device used for work conversations and confirm the installed version includes the RingRTC 2.72.0 fix. |
IMMEDIATE | Tell staff to check the call indicator after sensitive calls and to hold sensitive conversation until they have confirmed the call ended. |
SHORT-TERM | Inventory where consumer calling and messaging apps are used for operational or sensitive conversations, by role and device, and define which categories of communication require administered participants, controlled software versions, and organizational visibility. |
SHORT-TERM | Provide a sanctioned alternative that staff will actually use for those categories since prohibiting consumer apps without one may move the behavior out of sight. |
ONGOING | Track disclosures in shared calling components such as WebRTC-based libraries since one flaw can affect every client on every platform that uses them. |
BlackBerry Position
Signal fixed its shared calling library, which is the right response, and consumer-grade here describes who the tool is built for and says nothing about the quality of its engineering. A tool built for individuals leaves participation, device state, and update timing to each individual. That is reasonable for personal communication and unworkable where an organization is accountable for who takes part and what software carries the conversation. Mission-critical communications need the organization to hold those controls.
Citations:
1. Signal Vulnerability Lets Malicious Callers Block Hang-Ups (SecurityWeek, October 22, 2026).
2. Signal flaw could expose audio and video even after users hang up (Help Net Security, October 22, 2026).
3. ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More (The Hacker News, October 2026).
4. Russian Hackers Phish EU Officials Over Messaging Apps (Dark Reading, coverage of state-sponsored phishing of EU officials over messaging apps, August 2026).
5. State actors tried to hack EU officials' messaging apps, cybersecurity body warns (Euronews, coverage of the European Commission confidential presentation on messaging app compromise, August 2026).
6. CVE-2026-113380 Detail (National Vulnerability Database, Information Technology Laboratory, Source: MITRE, NVD Published Date: Oct 20, 2026, NVD Last Modified: Oct 31, 2026).
:quality(90):no_upscale())