Signal RingRTC Queue Saturation Blocks Call Teardown in Pre-2.72.0 Builds
A critical flaw in Signal’s RingRTC library allows remote peers to jam call teardown processes, risking persistent audio or video streams in affected versions.
Key points
- CVE-2026-113380 carries a CVSS score of 9.3, rated as critical severity.
- The vulnerability affects Signal RingRTC library versions prior to 2.72.0.
- Attackers can saturate the call’s FSM queue to interfere with local hangup actions.
The Signal RingRTC library contains a critical flaw that disrupts call termination procedures. According to the National Vulnerability Database record for CVE-2026-113380, this issue involves a peer saturating a call's finite state machine (FSM) queue. Environments using versions of the RingRTC library before 2.72.0 are exposed to this risk. The flaw allows a remote peer to interfere with the ability of a local hangup to tear the call down, including its audio and perhaps also video track.
Root cause
The underlying weakness is classified as CWE-754. In this specific case, the RingRTC library allows a peer to saturate the call’s FSM queue. This saturation interferes with the local client’s ability to execute the teardown sequence. The source material describes the issue as a peer saturating the queue to interfere with teardown, rather than a general resource management failure. This results in a failure to terminate the call session correctly.
Attack path
An attacker establishes a call connection and then saturates the FSM queue with data or commands. This action interferes with the local client’s ability to execute the teardown sequence. The result is a persistent call state where audio or video tracks may continue to run after the user attempts to disconnect. The source states that a peer can interfere with the ability of a local hangup to tear the call down.
Affected versions
- Signal RingRTC library versions prior to 2.72.0
- Any application bundling these older versions of the RingRTC component
Mitigation
- Upgrade the Signal RingRTC library to version 2.72.0 or later immediately.
- Verify that all deployed applications using the RingRTC component are patched.
- Monitor call logs for failed teardown attempts or persistent media streams.
Detection notes
Security teams should monitor application logs for anomalies in call termination sequences. Look for instances where hangup commands are issued but media streams remain active. Check for unusually high queue depths or state machine errors in the RingRTC component. Alert on repeated call setup failures or persistent audio/video tracks after user-initiated disconnects. Investigate any unexpected resource consumption spikes during active calls. Review network traffic for continuous media flow despite client-side hangup signals.
What to do and how to stay safe: Signal
- Inventory all systems using the Signal RingRTC library to identify vulnerable versions.
- Apply the update to RingRTC version 2.72.0 as soon as it is available.
- Monitor call quality and teardown logs for signs of queue saturation.
- Educate users to report calls that fail to disconnect properly.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-113380?
The National Vulnerability Database rates CVE-2026-113380 with a CVSS score of 9.3, which is considered critical.
Which versions of Signal RingRTC are affected?
All versions of the Signal RingRTC library before 2.72.0 are affected by this vulnerability.
What is the primary impact of this flaw?
The flaw allows a peer to interfere with the ability of a local hangup to tear down the call, including its audio and video tracks.
