CVE-2026-113380

In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.

CVSS

9.3

EPSS

0.003 (23.8th percentile)

CISA KEV

Not listed

Exploitation

none

Public exploits

None seen

State

PUBLISHED

Coverage

• Help Net Security◇Specialist. Specialist publisher: established trade press, or expert analysis with a track record3 hours ago

  Signal flaw could expose audio and video even after users hang up

  A flaw in Signal’s calling library could let the other person on a call keep receiving a user’s audio, and possibly video, after that user hangs up. Tracked as CVE-2026-113380, the vulnerability affects RingRTC versions before 2.72.0. RingRTC is the open source library that powers voice and video…

  ↗helpnetsecurity.com/2026/10/22/signal-ringrtc-v…(opens the publisher's site in a new tab)

What we observed