Signal messaging app faces critical security vulnerabilities

Security researchers have identified multiple critical vulnerabilities within the Signal messaging app. One issue involves the macOS application, where encryption keys are stored in plaintext alongside encrypted databases. This flaw, along with the unencrypted storage of attachments like images and audio, allows spyware to potentially access sensitive data. Researchers from Mysk demonstrated that this vulnerability could be used to clone a Signal installation onto a virtual machine without triggering warnings in the linked devices overview.

Additionally, a critical vulnerability (CVE-2026-113380) was discovered in Signal’s open-source RingRTC calling library. This flaw, which carries a CVSS score of 9.3, can prevent calls from terminating properly. By saturating the library’s finite state machine event queue with requests, a malicious actor could trigger a denial-of-service condition that keeps audio or video channels active even after a user attempts to hang up. Signal has released an update (version 2.72.0 or later) to address this calling library issue.