CVE-2026-113380 Signal CVE debrief

Who should care

Defenders responsible for Signal deployments using the RingRTC library should assess exposure and prioritize updating to version 2.72.0 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who manage Signal deployments. They should review call handling and teardown procedures, monitor for potential call interference, and plan vendor-supported updates or mitigations through normal change control.

Why it matters

Defenders should care about CVE-2026-113380 because it can cause a peer to interfere with the ability of a local hangup to tear down a call, potentially disrupting audio and video tracks. This vulnerability affects Signal deployments using the RingRTC library before version 2.72.0.

• Potential call interference, allowing a peer to prevent a local hangup from tearing down a call.
• Possible disruption of audio and video tracks in affected calls.

Technical summary

The vulnerability is caused by a peer saturating a call's FSM queue, which can interfere with the ability of a local hangup to tear down a call, including its audio and video tracks. This issue affects Signal deployments using the RingRTC library before version 2.72.0. The vulnerability can disrupt call handling, potentially allowing a peer to prevent a local hangup from tearing down a call. Defenders should prioritize updating to version 2.72.0 or later to prevent potential call interference. The vulnerability has a CVSS score of 9.3 and a severity of CRITICAL.

Defensive priority

Defenders should prioritize updating to version 2.72.0 or later to prevent potential call interference.

Recommended defensive actions

• Update to version 2.72.0 or later
• Review call handling and teardown procedures
• Monitor for potential call interference
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is described in the CVE Program record and the NVD vulnerability detail page. The RingRTC library is used in Signal, and the vulnerability can cause a peer to interfere with the ability of a local hangup to tear down a call. Evidence is limited to public CVE Program records and NVD vulnerability details. Defenders should verify affected scope and vendor guidance through official advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.