{"id":"CVE-2026-113380","kind":"vulnerability","aliases":["CVE-2026-113380"],"related":[],"title":"RingRTC: a peer can block a local hangup from tearing down a call","description":"In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.","summary":"RingRTC is the calling library inside Signal apps. A malicious call peer can fill the 256-entry call/connection FSM queue so a local hangup fails to finish teardown. Audio, and possibly video, can stay live after the user ends the call. Fixed in RingRTC 2.72.0 (Sep 4 2026), disclosed Oct 20. No known exploitation.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ringrtc","fixed":["2.72.0"],"affected":"< 2.72.0","ecosystem":"signal"}],"ecosystems":[],"tags":["desktop","mobile","package","ringrtc","signal","webrtc"],"not_affected_if":["unknown"],"how_to_check":"Update Signal on every device to the latest release. If you embed RingRTC, check the pinned version (Cargo.lock, package.json or the Android/iOS pod/AAR) and confirm it is 2.72.0 or later.","fix":"Upgrade ringrtc to 2.72.0 or later (2.72.1 is the latest tag). Signal users: install the latest Signal app update.","status":"open","published_at":"2026-10-20T05:16:54+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:39+00:00","updated_at":"2026-10-23T23:23:24+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:39:39Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the ringrtc library to 2.72.0 or later.","reach":"internet","title":"RingRTC: a peer can block a local hangup from tearing down a call","impact":"medium","summary":"RingRTC is the WebRTC calling library Signal uses. A remote peer that floods a call's state queue can stop a local hangup from ending the call, so audio and possibly video tracks stay live.","category":"package","who_cares":["ringrtc","signal","webrtc"],"confidence":0.6,"needs_auth":"unknown","worst_case":"A remote peer keeps a call's audio and video running after hangup.","analyst_note":"Confirm which apps embed ringrtc below 2.72.0 and whether the CVSS 9.3 score fits a call-teardown denial; check the NVD entry linked in sources.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000469,"input_tokens":2902,"output_tokens":357,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm which apps embed ringrtc below 2.72.0 and whether the CVSS 9.3 score fits a call-teardown denial; check the NVD entry linked in sources.","search":"'-113380':16A,19A '-2026':15A,18A '2.72.0':71B,86C '20':77B '2026':74B '256':42B '4':73B 'abil':102C 'also':116C 'app':34B 'audio':55B,113C 'block':5A 'call':13A,30B,37B,67B,94C,110C 'call/connection':44B 'cve':14A,17A 'desktop':21B 'disclos':75B 'end':65B 'entri':43B 'exploit':80B 'fail':51B 'fill':40B 'finish':53B 'fix':68B 'fsm':45B,96C 'hangup':8A,50B,106C 'insid':32B 'interfer':99C 'known':79B 'librari':31B,84C 'live':61B 'local':7A,49B,105C 'malici':36B 'mobil':22B 'oct':76B 'packag':23B 'peer':3A,38B,90C 'perhap':115C 'possibl':57B 'queue':46B,97C 'ringrtc':1A,20A,24B,27B,70B,83C 'satur':92C 'sep':72B 'signal':25B,33B,88C 'stay':60B 'tear':10A,108C 'teardown':54B 'track':118C 'user':64B 'video':58B,117C 'webrtc':26B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T05:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113380","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113380","severity":null,"published_at":"2026-10-20T05:16:54+00:00","modified_at":"2026-10-20T20:06:37+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113380:430","url":null,"severity":null,"published_at":"2026-10-23T23:23:24+00:00","modified_at":"2026-10-23T23:23:24+00:00","first_seen_at":"2026-10-23T23:23:24+00:00","fetched_at":"2026-10-23T23:23:24+00:00","note":"CVE record, fix commit 4b1b6fa (Sep 4 2026) and CyberInsider read. Fixed in RingRTC 2.72.0 (2.72.1 also tagged). Which Signal client builds bundle it is unknown; Signal did not say. No exploitation or PoC found. CVSS 4.0 9.3 (from MITRE) looks high for a hangup failure that needs a malicious call peer and user interaction; it is really a privacy issue (mic or camera stays live), so I left severity unchanged."}],"documents":[{"id":448,"url":"https://x.com/sans_isc/status/2113577565160182077","title":"@sans_isc: SANS Stormcast Friday, October 23rd, 2026: PHP2Shell Exploitation Update; Signal","kind":"post","source":"x","text":"SANS Stormcast Friday, October 23rd, 2026: PHP2Shell Exploitation Update; Signal Call Hang-Up Flaw (CVE-2026-113380); Cisco Snort 3 Critical Vulnerabilities; Linux KSMBD RCE Reports Leaked\n https://t.co/03fbCidRZE https://t.co/PwLmDFvKyC\n\nlikes 1 reposts 2","published_at":"2026-10-23T10:25:34+00:00","relation":"discussion","confidence":null,"note":"@sans_isc"},{"id":1928,"url":"https://github.com/signalapp/ringrtc/commit/4b1b6fa53c9f30c87c8ea78e44675d4a13e1e4d3","title":"ringrtc 4b1b6fa Ensure calls terminate completely in corner cases","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1929,"url":"https://cyberinsider.com/signal-fixes-critical-flaw-that-could-keep-audio-active-after-hangup/","title":"Signal fixes critical flaw that could keep audio active after hangup","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1931,"url":"https://www.cve.org/CVERecord?id=CVE-2026-113380","title":"CVE Record: CVE-2026-113380","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}