---
id: "CVE-2026-113380"
kind: "vulnerability"
aliases: ["CVE-2026-113380"]
title: "RingRTC: a peer can block a local hangup from tearing down a call"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ringrtc", "fixed": ["2.72.0"], "affected": "< 2.72.0", "ecosystem": "signal"}]
ecosystems: []
tags: ["desktop", "mobile", "package", "ringrtc", "signal", "webrtc"]
not_affected_if: ["unknown"]
published_at: "2026-10-20T05:16:54+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-23T23:23:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113380", "first_seen_at": "2026-10-23T21:57:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:23:24+00:00"}]
---

# RingRTC: a peer can block a local hangup from tearing down a call

RingRTC is the calling library inside Signal apps. A malicious call peer can fill the 256-entry call/connection FSM queue so a local hangup fails to finish teardown. Audio, and possibly video, can stay live after the user ends the call. Fixed in RingRTC 2.72.0 (Sep 4 2026), disclosed Oct 20. No known exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- signal:ringrtc affected < 2.72.0 fixed 2.72.0

## How to check

Update Signal on every device to the latest release. If you embed RingRTC, check the pinned version (Cargo.lock, package.json or the Android/iOS pod/AAR) and confirm it is 2.72.0 or later.

## Fix

Upgrade ringrtc to 2.72.0 or later (2.72.1 is the latest tag). Signal users: install the latest Signal app update.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113380
- 2026-10-23T23:23:24+00:00 analyst — CVE record, fix commit 4b1b6fa (Sep 4 2026) and CyberInsider read. Fixed in RingRTC 2.72.0 (2.72.1 also tagged). Which Signal client builds bundle it is unknown; Signal did not say. No exploitation or PoC found. CVSS 4.0 9.3 (from MITRE) looks high for a hangup failure that needs a malicious call peer and user interaction; it is really a privacy issue (mic or camera stays live), so I left severity unchanged.

## Documents

- [advisory] CVE Record: CVE-2026-113380 https://www.cve.org/CVERecord?id=CVE-2026-113380
- [describes] Signal fixes critical flaw that could keep audio active after hangup https://cyberinsider.com/signal-fixes-critical-flaw-that-could-keep-audio-active-after-hangup/
- [discussion] @sans_isc: SANS Stormcast Friday, October 23rd, 2026: PHP2Shell Exploitation Update; Signal https://x.com/sans_isc/status/2113577565160182077
- [fix] ringrtc 4b1b6fa Ensure calls terminate completely in corner cases https://github.com/signalapp/ringrtc/commit/4b1b6fa53c9f30c87c8ea78e44675d4a13e1e4d3

## From the sources

In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_