Skip to content
THREATWIRE
CriticalPoC Available

CVE-2026-113380

Signal RingRTC call may stay live after hang-up (FSM queue saturation)

In Signal's RingRTC calling library before 2.72.0, a call peer that fills the call's internal event queue can stop a local hang-up from fully tearing the call down. Audio, and perhaps video, may keep flowing. Fixed in RingRTC 2.72.0 (4 September 2026). CVSS 4.0 9.3. Not in CISA KEV. No known exploitation.

By ThreatWire Desk · Published 20 Oct 2026 · Updated 22 Oct 2026

CVSS
9.3
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:N/SA:N/S:P
Class
Info disclosure
Status
PoC Available
KEV
Not in CISA KEV
0-day
No
Vendor
Signal
Products
RingRTC, Signal Android, Signal iOS, Signal Desktop
Affected
RingRTC before 2.72.0 (npm @signalapp/ringrtc, per the CVE record). Signal clients that bundle an older RingRTC: Android before 8.27.0, iOS before 8.30 and Desktop before 8.29.0, based on the RingRTC version pinned in Signal's public source tags. Signal has not published an affected-version list for its apps.
Fixed
RingRTC 2.72.0 (4 September 2026) and later. First Signal releases tagged with RingRTC 2.72.0 or later: Android 8.27.0, iOS 8.30 (build 8.30.0.1882) and Desktop 8.29.0. Current releases ship RingRTC 2.72.1 or 2.73.0.
CWE
CWE-754
Published
20 Oct 2026
Updated
22 Oct 2026

The status above is the claim. Links do not upgrade it.

CVE-2026-113380 is a flaw in RingRTC, the open-source library behind Signal voice and video calls. It is fixed in RingRTC 2.72.0.

The CVE record says a call peer can saturate the call's internal event queue. A local hang-up may then fail to fully tear the call down. The call's audio track, and perhaps video, can stay up after you hang up.

RingRTC runs calls through state machines with a bounded event queue of 256 entries. The fix commit shows that, before 2.72.0, termination could stop early if a step failed. A full queue was one such failure. Later cleanup steps then never ran.

Signal's fix adds a separate "terminate requested" flag that the call and connection state machines check directly. It caps shutdown waits at five seconds. Cleanup now continues even when a step fails. New tests cover saturated queues and confirm hang-up turns off outgoing audio.

The fix was committed on 4 September 2026 by Signal engineer Jim Gustafson. RingRTC 2.72.0 shipped the same day. Its changelog only says "Ensure calls terminate completely in corner cases". The CVE was published on 20 October 2026.

The CVE record scores it CVSS 4.0 9.3 (Critical). The full vector is in the CVSS field. The record was filed through MITRE, not by Signal. Signal has not published its own advisory or score. NVD lists it as awaiting analysis. VulDB rates it lower and maps it to resource consumption, so expect the score to be debated.

Fixed Signal apps. Signal has not published app versions for this CVE. Signal's public source tags show the first releases bundling RingRTC 2.72.0 or later:

  • Android: 8.27.0
  • iOS: 8.30 (build 8.30.0.1882)
  • Desktop: 8.29.0

Current Signal releases ship RingRTC 2.72.1 or 2.73.0. Update to the latest version on every device.

Exploitation. The CVE is not in the CISA KEV catalog. CISA's assessment lists exploitation as none. No attacks have been reported. Credits for the report are not published yet.

PoC status. A public write-up linked from the CVE record includes a small script. ThreatWire reviewed it without running it. It is a synthetic offline model of a queue, not code that targets Signal or RingRTC. We do not count it as a working PoC. ThreatWire has not run it.

Read the full explainer and update checklist. For another recent messaging-app flaw, see Telegram Desktop CVE-2026-107181.

Sources

Related on ThreatWire

Share on X@threatwire_https://www.threatwire.tech/cve/cve-2026-113380