Signal RingRTC: Call teardown interference via FSM queue saturation
Summary
RingRTC, the library that powers Signal's voice and video calls, is affected before version 2.72.0. A peer that floods a call's internal state machine queue can prevent a local hang-up from fully ending the call, so audio and possibly video may stay active. The attack requires a remote call peer and some user interaction; the CVSS 4.0 score of 9.3 comes from the CVE record and could not be confirmed against NVD.
Affected
- RingRTC versions before 2.72.0
- Signal client applications that embed RingRTC before the fixed release (exact app versions: Unknown.)
Fixed in
- RingRTC 2.72.0 (fix commit 4b1b6fa53c9f30c87c8ea78e44675d4a13e1e4d3)
- Signal app versions containing the fix: Unknown.
Workaround
- Unknown. The vendor advice is to update to RingRTC 2.72.0 or later.
- Users who cannot update immediately should check the call indicator to confirm that a call has actually ended (secondary reporting, not a Signal advisory).
Exploitation
- No known exploitation in the wild.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- A public write-up exists; press reports state its demonstration runs offline and does not attack Signal.
Our recommendation
- Update all Signal clients (mobile and desktop) to the latest release and confirm it includes the RingRTC 2.72.0 fix.
- Check third-party software that embeds RingRTC below 2.72.0 and request an update from its vendor.
- Prioritise staff who make calls with external or untrusted contacts on Signal.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (CVE-2026-113380) raw data raw.githubusercontent.com
- Signal RingRTC fix commit 4b1b6fa github.com
- RingRTC comparison v2.71.0...v2.72.0 github.com
- SecurityWeek: Signal vulnerability lets malicious callers block hang-ups www.securityweek.com
- Help Net Security: Signal RingRTC vulnerability CVE-2026-113380 www.helpnetsecurity.com
- Public write-up by researcher (GitHub) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:07.
Original description (NVD)
In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.