CVE-2026-113380
Received Received - Intake

Signal RingRTC FSM Queue Saturation Enables Call Tear Down Interference

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: MITRE

Description
In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113380
EUVD
EUVD-2026-104796

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Signal RingRTC 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the RingRTC library before 2.72.0 allows a peer to disrupt call termination by overwhelming the call's FSM queue. This can prevent a local hangup from fully tearing down the call, leaving audio and possibly video tracks active.

Detection Guidance

This vulnerability involves call termination issues in the RingRTC library. Detection requires checking the RingRTC version in use. If your system uses RingRTC version 2.71.0 or earlier, it is vulnerable. Commands to check the version depend on the Signal client implementation. For Signal Desktop, inspect the package.json or installed version via package manager. For Android/iOS, check the app version in settings or via ADB/device logs.

Impact Analysis

An attacker could exploit this to keep calls active indefinitely, potentially eavesdropping on audio or video even after a user attempts to end the call. This could lead to privacy breaches or unauthorized access to sensitive communications.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR and HIPAA by enabling unauthorized retention of audio/video data after a call ends. Compliance may require ensuring calls terminate properly to avoid unauthorized data exposure.

Mitigation Strategies

Upgrade RingRTC to version 2.72.0 or later. This version includes a timeout mechanism and fixes for call termination issues. For Signal clients, update the application to the latest version. If using a custom build, apply the patch from commit 4b1b6fa or update to v2.72.0. Ensure all peers in a call can terminate properly by verifying the fix is applied across all endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113380. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart