CVE-2026-113380CVSS 9.3Call termination blocked by event-queue saturation
A call peer can interfere with local hang-up processing, potentially keeping media tracks active.
Signal's RingRTC bug can leave call audio active after a local hang-up
A malicious call peer can flood RingRTC's event queue and obstruct local call termination, leaving audio and possibly video active. CVE-2026-113380 affects RingRTC before 2.72.0; update Signal clients to builds containing the fixed library.
- Disclosed
- Oct 20, 2026
- Public disclosure date
- Severity
- CVSS 9.3
- 1 CVE tracked here
- Splash zone
- Signal clients embedding RingRTC before 2.72.0
- signal
- In the wild
- Not seen
- CISA's October 20 assessment lists no exploitation; the public demo is synthetic
What happened
CVE-2026-113380 concerns Signal’s RingRTC calling library. An existing call peer can saturate its finite-state-machine queue, delaying the local hang-up path while audio, and potentially video, continues. This requires participation in a call; the sources do not establish silent capture of an idle device.
The vendor’s patch tracks termination requests separately from queued events. RingRTC 2.72.0 is the fixed library threshold. The library release on September 4 and public vulnerability disclosure on October 20 are different dates. Neither that threshold nor the release date establishes the first fixed Signal app version for each operating system.
This is L3 because a mainstream communications component has a credible confidentiality failure. The published demonstration models queue behavior offline; it is not a working Signal exploit. CISA’s October 20 assessment records no exploitation. That assessment does not prove attacks have never occurred.
What’s in the bowl
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| RingRTC | 2.72.0 | |
| Signal applications | unknown | Exact first fixed app versions are not established by the sources reviewed |
Crime-scene timeline
Sep 4, 2026
RingRTC 2.72.0 released
The library fix predates the public CVE disclosure.
Oct 20, 2026
CVE published
MITRE publishes the affected range and CVSS 4.0 score; CISA records no exploitation in its assessment.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- MITRE CVE record and CISA enrichmentPrimaryPublished October 20; before 2.72.0 affected; CVSS 4.0 9.3; CISA exploitation assessment is none
- Signal RingRTC fixPrimaryCall termination requests are tracked independently of queued FSM events
- Signal RingRTC changelogPrimaryDocuments the 2.72.0 library release
- Public technical note and conceptual demonstrationPrimaryDemonstrates queue starvation with an offline model, not an exploit against real Signal calls