Signal RingRTC flaw blocks call teardown in versions before 2.72.0
A critical vulnerability in Signal’s RingRTC library allows peers to interfere with local hangup processes by saturating call queues.
Key points
- CVE-2026-113380 is rated Critical with a CVSS score of 9.3.
- The flaw affects the RingRTC library in Signal versions prior to 2.72.0.
- Attackers can saturate a call's FSM queue to prevent proper teardown.
A critical vulnerability has been identified in the RingRTC library used by the Signal messaging platform. The National Vulnerability Database records this flaw as CVE-2026-113380, assigning it a CVSS score of 9.3. This high severity rating reflects the significant potential for disruption within voice and video call sessions for affected users.
At a glance
- CVE
- CVE-2026-113380
- Product
- Signal RingRTC
- CVSS
- 9.3 Critical
- Weakness
- CWE-754
- Exploited
- No known exploitation
The vulnerability exists in all versions of the RingRTC library before 2.72.0. According to the NVD record, the weakness is categorized under CWE-754. The issue arises when a peer participant in a call saturates the finite state machine queue associated with that specific call session.
Technical Context
The core problem involves the ability of a remote peer to interfere with the local hangup process. When the FSM queue is saturated, the local client may fail to properly tear down the call. This interference prevents the standard cleanup procedures from executing as intended during a disconnect attempt.
The NVD description notes that this failure to tear down the call affects the audio track and potentially the video track as well. The saturation of the queue essentially blocks the mechanism that should dismantle the media streams and connection state when a user attempts to end the conversation.
Who Is Affected
This issue specifically impacts users of the Signal application who are running versions of the software that utilize the RingRTC library prior to version 2.72.0. Any peer-to-peer call established on these older versions is susceptible to this queue saturation technique.
Developers or organizations maintaining internal builds of Signal must verify their RingRTC library version. If the version number is lower than 2.72.0, the application is considered vulnerable to this specific interference vector. Users on updated versions are not affected by this particular CVE.
What should you do?
Security teams should audit their deployment of Signal clients to identify any instances running the vulnerable RingRTC library. Since no patch has been confirmed in the source material beyond the version threshold, upgrading to version 2.72.0 or later is the primary mitigation.
What to do and how to stay safe: Signal
- Verify the version of the RingRTC library currently in use by your Signal clients.
- Update Signal to version 2.72.0 or higher once available from official channels.
- Monitor for official advisories regarding CVE-2026-113380 from Signal developers.
- Review call logs for unusual termination behaviors that might indicate queue saturation.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-113380?
It is a critical vulnerability in Signal's RingRTC library before version 2.72.0 where a peer can saturate a call's FSM queue.
What is the CVSS score for this flaw?
The National Vulnerability Database assigns CVE-2026-113380 a CVSS score of 9.3, which is rated as Critical.
Does this flaw allow data exfiltration?
The source material does not state that data exfiltration occurs; it only describes interference with the ability to tear down audio and video tracks.
