Loading vulnerability…
Call termination bypass through FSM queue saturation in Signal RingRTC
CVE-2026-113380 affects Signal's WebRTC-based RingRTC calling library before version 2.72.0. A malicious call participant can saturate the call's finite-state-machine (FSM) event queue, interfering with processing of a local hangup and preventing complete call teardown. Local termination handling can become blocked by peer-originated events, potentially leaving outgoing audio and possibly video active after the user attempts to end the call. The vulnerability concerns call-state management rather than a failure of end-to-end encryption.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Failed call teardown could allow a malicious participant to continue receiving microphone audio after the other participant believes the call has ended, exposing nearby conversations and other private sounds. Continued camera transmission is a potential consequence but is not confirmed. The duration of unintended transmission and the application's visible behavior during failed teardown are not established. The vulnerability has a reported CVSS v4.0 score of 9.3; no exploitation in the wild is known.
If you can’t patch tonight, do this now.
As an additional precaution, check that call and microphone activity indicators have stopped after hanging up before discussing sensitive information nearby. Indicator checks are not a substitute for updating and do not establish that vulnerable call teardown is reliable.
Patch, then assume compromise.
Upgrade RingRTC to version 2.72.0 or later and rebuild or update applications incorporating the library. The fix introduces a termination flag that call and connection state machines can check independently of the overloaded event queue, along with five-second shutdown-wait limits so cleanup can proceed when individual operations fail. Signal users should install the latest available application updates on all mobile and desktop devices. Exact first-fixed Signal application versions across platforms are not consistently established; RingRTC 2.72.0 is a library version, not a Signal application version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
45 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.