CVE-2026-113380: Critical severity Signal RingRTC vulnerability
Published Oct 20, 2026
·Updated
In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.
Affected Software
1 affected component
Signal RingRTC<2.72.0
Event History
Oct 20, 2026
CVE Published
via MITRE·04:25 AM
Data Sourced
via MITRE·04:25 AM
DescriptionWeakness
Data Sourced
via NVD·05:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which RingRTC versions require remediation?
RingRTC versions before 2.72.0 are affected. The referenced comparison identifies v2.72.0 as the fixed release.
2
What does an attacker need to do to exploit this issue?
The attacker must be a peer in a call and saturate that call's finite-state-machine queue. The vulnerability does not describe any need for prior privileges.
3
What is the observable impact during an affected call?
A local hangup may fail to tear down the call. The call's audio track can remain active, and the video track may also remain active.