CVE-2026-113380
In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can…
- Risk score
- 66/100
- CVSS
- 9.3 v4.0
- Exploit chance (30 days)
- 0.3%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A vulnerability in the RingRTC library before 2.72.0 for Signal allows a peer to interfere with a local hangup, potentially causing a call to remain active. An attacker could exploit this to maintain a call despite a local hangup.
- Affected
- {'products': ['RingRTC library'], 'packages': [], 'versions': ['before 2.72.0']}
- Fix
- Check the linked advisory for a fix, as none is provided.
- Exploitation
- No known exploitation
In the news
TL;DR
Critical vulnerability in RingRTC library before 2.72.0 for Signal, allowing peers to interfere with call hangups.
- Help Net Security reports that the PHP security team has announced an urgent security release for two vulnerabilities, each rated 9.2 (Critical) under CVSS v4.0.
- The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without…
- SecurityWeek reports that the RingRTC library vulnerability is not mentioned in the PHP security release.
- The RingRTC library vulnerability is remotely exploitable without logging in, with a CVSS score of 9.3.
AI summary of 1 article.
Why it is Amber
- CVSS 9.3 critical
- Remotely exploitable without logging in
References
Original description
In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.
Last activity 20 Oct 2026. Patch Forecast updates every hour.