CVE-2026-113380

No known exploitation. EPSS puts it in the 24th percentile. Fixed in 2.72.0.

CVSS —Not scored EPSS percentile24th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix2.72.0Upgrade to this build

Published 2026-10-20Updated 2026-10-20Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Signal RingRTCAffected: < 2.72.0Upgrade to: 2.72.0Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your business uses Signal or any app/service built on the RingRTC library for voice or video calls.
Confirm the RingRTC version in use is below 2.72.0.
Update to RingRTC version 2.72.0 or later as soon as it's available through your app/vendor update.
If you can't update immediately, advise staff to force-close the call app after hanging up as a temporary precaution.
Watch vendor release notes for confirmation that your Signal client has incorporated the fix.

Usually a quick update

Coverage timeline

2 publishers

Signal resolved a critical vulnerability (CVE-2026-113380) in RingRTC that allowed malicious callers to block call hang-ups, keeping audio and video streams active.
as reported · Oct 22, 2026·SecurityWeek summary
A vulnerability in Signal's RingRTC library allows attackers to continue receiving audio or video after a user hangs up by saturating the call's FSM queue, with a conceptual proof-of-concept published but no confirmed in-the-wild exploitati
as reported · Oct 22, 2026·Help Net Security summary

Sourced from public security reporting — each date is when it was published, not when it happened. 1 further article named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.

In plain language

Written by AI from the record

A bug in the RingRTC call software used by Signal could let someone on a call keep your microphone and camera running even after you hang up; it's fixed in version 2.72.0 and there's no sign anyone is exploiting it yet, but it's worth getting updated.

CVE-2026-113380 is a resource-exhaustion flaw (CWE-754) in RingRTC before 2.72.0 where a remote peer can flood a call's finite-state-machine queue, preventing a local hangup from properly tearing down the audio/video tracks.

If you're affected

Unintended microphone/camera exposure
Privacy breach during calls
Operational disruption of call app
Reputational risk if exploited

What is it

Think of this like a phone that doesn't fully hang up when you press 'end call' — the other person could still hear or see you for a bit longer than expected. It happens because the other side of the call can overload the app's internal task queue, which interferes with the hangup process.

Who is affected

This matters to you if your business uses Signal or any product that embeds the RingRTC calling library for voice or video calls. It only becomes a risk during an active call with someone who deliberately triggers the flaw, not from any setup or configuration you control.

How urgent is it

There's no evidence of this being exploited in the wild, and no public exploit code exists, so this isn't an emergency to drop everything for. Still, because it involves unintended audio/video exposure during calls, treat it as a priority to patch within your normal update cycle rather than ignoring it.

What to do — in detail

Inventory any applications or internal tools that embed the RingRTC library, not just the standalone Signal app. 2. Verify the RingRTC version in use; anything before 2.72.0 is vulnerable. 3. Upgrade to RingRTC 2.72.0 or later — for most users this arrives as a normal Signal app update, so simply ensure auto-update is enabled and the client has refreshed since the patch release. 4. There is no documented workaround beyond manually ending the call session or closing the app fully if hangup behavior seems stuck. 5. Monitor for any unusual prolonged mic/camera activity indicators after calls as a sign the issue may be present pre-patch. 6. No CISA KEV listing exists, so there is no mandated remediation deadline; follow your organization's standard patch SLA for medium-severity, non-exploited issues.

Technical context

Weakness: CWE-754 (improper check for unusual conditions), triggered by a remote peer saturating the call finite-state-machine (FSM) queue, which blocks proper execution of the local hangup teardown path for audio/video tracks. No KEV listing, no public exploit code, and predicted exploitation likelihood is low with a flat trend, consistent with proof-of-concept-level risk rather than active exploitation. Press attention is limited to patch-release coverage, not exploitation reports. Fixed in RingRTC 2.72.0.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS24th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 24th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 0 days, from the signal feeds we watch.

2026-10-20Publishedweakness classified, record updated, record updated, record updated

Affected products

Signaloss-project · USaka signal messenger, signal-desktop, private messenger
- RingRTCMixedCommunications / messaging-chat

Technical detail

Weaknesses

CWE-754No name in the record

Sources

References in the record

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for RingRTC, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account