Signal RingRTC CVE-2026-113380 (CVSS 4.0 9.3 in the CVE record): a call peer that floods the call's event queue can stop the victim's hang-up from tearing the call down, leaving audio and perhaps video running; fixed in RingRTC 2.72.0

The CVE record for CVE-2026-113380, published on 20 October 2026, says that in the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's finite-state-machine (FSM) queue can interfere with the ability of a local hang-up to tear the call down, with its audio and perhaps also video track. RingRTC is the library behind Signal voice and video calls. The record classifies it as CWE-754 and carries a CVSS 4.0 score of 9.3 (Critical); its references are Signal's RingRTC fix commit and the 2.71.0 to 2.72.0 comparison. Signal's commit, titled 'Ensure calls terminate completely in corner cases', bounds each FSM event channel at 256 events and adds a five-second limit on waiting for an FSM to quiesce before tearing down anyway. The researcher who published the write-up, Imahian, says the issue covers every Signal client embedding an older RingRTC build (Android, iOS and Desktop) until the client ships the fixed library, and that the accompanying proof of concept is synthetic and offline, not a working exploit. Security Affairs reported the flaw on 22 October. No exploitation has been reported. Source: CVE record CVE-2026-113380 (20 Oct 2026); Signal RingRTC commit; wire: Security Affairs (22 Oct).

Product

Signal RingRTC calling library (used by Signal apps for voice and video calls)

Versions

RingRTC before 2.72.0 (CVE record); fixed in 2.72.0. App build numbers not checked against a Signal release note.

CVSS

9.3 (CVSS 4.0, CVE record)

Exploited in Australia?

unknown

Patch to

Update Signal on every phone and desktop to the latest release from the official app store or signal.org. Developers embedding @signalapp/ringrtc: move to 2.72.0 or later. Until updated, after ending a sensitive call check that the call and microphone indicators have actually cleared (the researcher's advice).

Primary: CVE-2026-113380 — CVE record (published 20 Oct 2026) · Vendor: Signal — RingRTC fix commit 'Ensure calls terminate completely in corner cases' · CVE: CVE-2026-113380 · Security Affairs — Signal vulnerability could keep calls alive after users hang up (22 Oct 2026) · Imahian — CVE-2026-113380 RingRTC (Signal) write-up (researcher)

vulnerabilities