Signal RingRTC CVE-2026-113380 lets callers block hang-ups
CVE-2026-113380, rated CVSS 9.3, in Signal's RingRTC calling library lets a call peer saturate the FSM event queue and block hang-up processing. Audio and in some cases video may keep transmitting after the user ends the call. The flaw is fixed in RingRTC 2.72.0.
- CVE-2026-113380 carries a CVSS score of 9.3
- FSM queue saturation blocks hang-up processing
- Audio and sometimes video may continue after hang-up
- The fix shipped in RingRTC 2.72.0
Read next
Security