In RingRTC before 2.72.0, the WebRTC-based calling library Signal uses, a remote peer could fill a call's state-machine event queue so a local hang-up stayed stuck behind attacker events. That kept the call, its audio and possibly video, running after the user believed it had ended. Signal fixed it on Sep 4 by handling termination outside the queue. The CVE record and a researcher write-up with a conceptual PoC went public on Oct 20. Current Signal apps include the fix; update any stale installs, especially desktop clients that don't auto-update.