Live › vulnerability › CVE-2026-113380
Go to dashboardRingRTC is the calling library inside Signal apps. A malicious call peer can fill the 256-entry call/connection FSM queue so a local hangup fails to finish teardown. Audio, and possibly video, can stay live after the user ends the call. Fixed in RingRTC 2.72.0 (Sep 4 2026), disclosed Oct 20. No known exploitation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ringrtc | signal | < 2.72.0 | 2.72.0 |
2.72.0 or later2.72.0 or later (2.72.1 is the latest tag)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
@sans_isc · X1 likes · 2 reposts2026-10-23 10:25“SANS Stormcast Friday, October 23rd, 2026: PHP2Shell Exploitation Update; Signal Call Hang-Up Flaw (CVE-2026-113380); Cisco Snort 3 Critical Vulnerabilities; Linux KSMBD RCE Reports Leaked https://t.co/03fbCidRZE https://t.co/PwLmDFvKyC”
View on X
Posts are quoted with a link to the original. They are data to us, never instructions.
In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.
This page as .md · .json · in your agent: get_signal("CVE-2026-113380")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.