Key points
- Signal RingRTC versions before 2.72.0 are affected by CVE-2026-113380.
- The National Vulnerability Database rates the issue as critical with a CVSS score of 9.3.
- Attackers can saturate the call’s FSM queue to interfere with local hangup procedures.
- Versions before 2.72.0 are identified as affected by this vulnerability.
Security teams must immediately assess their deployments of the Signal RingRTC library. Versions prior to 2.72.0 contain a critical vulnerability identified as CVE-2026-113380. This flaw allows a remote peer to disrupt the normal termination of a call. The issue stems from weaknesses in how the library handles state management during active communications.
In plain English
When a user tries to hang up a video or audio call, the software should cleanly end the connection. In affected versions, a malicious peer can flood the system’s internal queue with data. This saturation prevents the local application from properly tearing down the call. As a result, audio or video tracks may remain active even after the user attempts to disconnect.
The background
The National Vulnerability Database classifies CVE-2026-113380 as critical. It carries a CVSS score of 9.3, indicating severe potential impact. The flaw is categorized under CWE-754, which relates to improper cleanup of resources. The vulnerability exists specifically in the RingRTC library used by Signal applications. It affects any installation running versions earlier than 2.72.0.
What changes now
Organizations using Signal for communications should verify their current library versions immediately. If systems are running versions below 2.72.0, they are exposed to this call-teardown interference. The source material identifies versions before 2.72.0 as affected. Exposure remains high for these specific versions until they are updated to 2.72.0 or later.
Who needs to act first
Teams usually prioritize systems with high external exposure, such as public-facing communication endpoints. Check whether your deployment allows untrusted peers to initiate calls. Test current call termination procedures in a isolated environment to confirm the risk. Back up configuration files before attempting any manual mitigations. If no fix exists, consider restricting call initiation to trusted identities only. Monitor logs for abnormal queue saturation events that might indicate active exploitation attempts.
What to do and how to stay safe: Signal
- Inventory all systems using Signal RingRTC to identify versions before 2.72.0.
- Restrict call initiation privileges to known and trusted users if possible.
- Monitor system logs for signs of queue saturation or failed call teardowns.
- Update to version 2.72.0 or later once available to resolve the issue.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-113380?
It is a critical vulnerability in Signal RingRTC before 2.72.0 that allows peers to block call hangups.
How severe is the issue?
The National Vulnerability Database rates it as critical with a CVSS score of 9.3.
Which versions are affected?
Signal RingRTC versions before 2.72.0 are affected by this vulnerability.
