CVE-2026-113380

In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track

Signal RingRTC

CVSS

9.3Critical

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in2.72.0Fixed versionCVE List

Published20 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

2.72.0RingRTCCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

@hacker.at.thenote.app: Signal Vulnerability Could Keep Calls Alive After Users Hang Up A critical Signal flaw could keep calls active after hang-up, exposing microphone or camera. Update to a fixed versiBluesky: CVE posts, 23 Oct 2026

Description

In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.

Text from CVE List

Affected versions 1

RingRTCaffected: all versions before 2.72.0CVE List