CVE-2026-113380: RingRTC Signal Vulnerability
TL;DR - CVE-2026-113380 affects RingRTC versions before 2.72.0. - A remote call peer may saturate the finite-state-machine queue and interfere with local hangup processing, leaving audio or possibly video active. - Upgrade to RingRTC 2.72.0 or later and verify the version bundled by downstream Signal applications. - No confirmed in-the-wild exploitation or dedicated public proof of concept is known.
Are You Affected?
CVE-2026-113380 is a RingRTC vulnerability affecting the library used by Signal applications to provide voice and video calling over WebRTC. The vulnerable condition exists in RingRTC versions before 2.72.0. The available upstream comparison covers changes between v2.71.0 and v2.72.0, so RingRTC 2.71.0 and earlier should be treated as affected unless a downstream vendor has backported the fix.
| Field | Assessment |
|---|---|
| CVE ID | CVE-2026-113380 |
| CVSS score | 9.3 |
| Attack vector | Not provided in the reviewed NVD record |
| Authentication required | Not provided in the reviewed NVD record |
| Patch available | Yes |
| Affected product | RingRTC |
| Affected versions | All versions before 2.72.0 |
| Fixed version | RingRTC 2.72.0 |
| Downstream exposure | Signal applications and other products that bundle or link vulnerable RingRTC versions |
The record does not provide a CVSS vector, so attack vector and authentication requirements cannot be responsibly reconstructed. The technical description indicates that a remote call peer can trigger the condition, but that is not a substitute for the missing formal CVSS component data. Treat deployments that accept calls from untrusted or external peers as exposed until the bundled RingRTC version is verified.
Signal application version numbers are not specified in the available advisory material. This matters because Signal distributions may vendor RingRTC inside application packages rather than expose it as a separately updateable library. Inventory the actual library or binary contents, then consult the relevant Signal release or dependency metadata before declaring a deployment remediated.
For a broader vulnerability-management workflow, see this CVE remediation guide.
Analyst’s Take: The first response should be an inventory of the RingRTC version actually shipped in production, not a check of the application’s top-level version alone. The missing CVSS vector limits what can be inferred about attack details, but the remote-call condition and 9.3 score support treating externally callable deployments as a priority.
The Fix, If You’re in a Hurry
Upgrade RingRTC to 2.72.0 or later. If your product consumes RingRTC from the upstream repository, update the dependency or source checkout to the v2.72.0 tag and rebuild the application.
Technical Notes: Upgrade Procedure
git fetch --tags origin
git checkout v2.72.0
git submodule update --init --recursive
# Run the downstream project's documented build and test command.
For a downstream application, the exact package-manager command depends on how RingRTC is integrated. Update the dependency lockfile, vendored source, or build manifest to reference 2.72.0 or a later release. Do not assume that updating the Signal application alone is sufficient unless the release notes or package inspection confirms that the embedded RingRTC component is at least 2.72.0.
No complete workaround is documented in the reviewed sources. If an immediate upgrade is impossible, reduce exposure to untrusted calling peers where operationally feasible and consider temporarily restricting inbound calling at the policy or fleet-management layer. These controls reduce risk but do not fix the vulnerable queue-handling behavior, and they may not prevent abuse by permitted contacts.
Endpoint security can provide additional visibility into affected application behavior, but it cannot replace the RingRTC update. Organizations reviewing endpoint controls may consider Malwarebytes for endpoint protection as part of a broader defense strategy.
After updating, verify the deployed artifact rather than relying only on build configuration. Check the dependency lockfile, packaged native libraries, application metadata, or software bill of materials. Test call setup and teardown, including calls from external accounts, and confirm that audio and video tracks stop promptly after a local hangup.
How This Vulnerability Works
RingRTC provides Signal applications with calling services built on WebRTC. Call control is coordinated through a finite-state machine, or FSM, that processes signaling and lifecycle events such as call setup, negotiation, remote actions, and local hangup. The vulnerability concerns how that state machine handles a saturated event queue.
According to the available vulnerability description, a remote peer can generate enough call-state activity to saturate the local FSM queue. Once the queue is full or otherwise unable to process the hangup event normally, the local user’s request to end the call may not tear down the call completely. The result can be a call that remains logically or operationally active, with audio and possibly video tracks still associated with the session.
This is a call-control and media-session teardown failure. The reviewed material does not establish remote code execution, privilege escalation, information disclosure, authentication bypass, or persistent access. It also does not provide a complete code-level root-cause analysis. Maintainers who need to understand the precise implementation change should review the upstream fix commit and the v2.71.0...v2.72.0 comparison.
Technical Notes: State-Machine Impact
The expected failure sequence can be represented conceptually:
Remote signaling activity
|
v
Local call FSM queue becomes saturated
|
v
Local hangup event is delayed, rejected, or not processed
|
v
Call teardown is incomplete
|
v
Audio, and possibly video, remains active
This model describes the reported behavior, not an assertion about the exact internal control flow. Avoid interpreting the issue as a general WebRTC media vulnerability. The documented exposure is specifically associated with RingRTC call-state queue handling before version 2.72.0.
Severity, Explained
The reported CVSS base score is 9.3, which places the issue in the critical range. However, the reviewed NVD response does not include the CVSS vector. Without the vector, defenders cannot independently confirm the attack vector, attack complexity, privileges required, user interaction, scope, confidentiality impact, integrity impact, or availability impact components.
The high score should drive prompt remediation, particularly for products that accept calls from untrusted remote peers. Teams should still describe the impact accurately. The available technical description supports a denial-of-service or availability-oriented call teardown problem that may leave media active. It does not, by itself, support claims of code execution or data theft.
Technical Notes: What Is Known and Unknown
| CVSS element | Available information |
|---|---|
| Base score | 9.3 |
| Vector string | Not provided |
| Attack vector | Unknown from the supplied record |
| Privileges required | Unknown from the supplied record |
| User interaction | Unknown from the supplied record |
| Confidentiality impact | Not established |
| Integrity impact | Not established |
| Availability impact | Call teardown and media-session availability impact is described |
Do not manufacture a vector string to fill the gap in vulnerability-management systems. Record the score as supplied, retain the missing-vector caveat, and prioritize based on actual exposure: internet-reachable or externally callable deployments deserve the fastest response.
Is It Being Exploited?
No confirmed in-the-wild exploitation was identified in the reviewed NVD, CISA Known Exploited Vulnerabilities, or upstream repository material. CVE-2026-113380 is not listed in the CISA KEV catalog, and there is no CISA-assigned due date, ransomware-campaign designation, or federal remediation deadline for this CVE.
No dedicated public exploit or proof-of-concept repository was identified in the reviewed sources. That does not prove that exploitation is impossible or that private demonstrations do not exist. It means defenders should distinguish the technically plausible remote trigger from verified public exploitation evidence.
The absence of KEV status is not a safety guarantee. A remote peer may still be able to abuse the issue against an unpatched deployment, and a future public proof of concept could reduce the effort required to reproduce it. Prioritize remediation based on exposure and the criticality of calling services rather than waiting for exploitation confirmation.
Detecting It in Your Environment
Detection is difficult because the described failure may not produce a unique security log entry. Correlate abnormal signaling volume, repeated call-state transitions, failed or delayed hangups, and media tracks that remain active after the user ends a call. The precise event names vary by Signal application, platform, and RingRTC integration.
A useful operational signal is a call where the local hangup occurs but the media session does not close within the application’s normal teardown interval. Capture application logs, WebRTC statistics, and endpoint telemetry around the event. Avoid logging call content or sensitive identifiers; use pseudonymous call IDs and timestamps where possible.
Technical Notes: Example Detection Query
The following pseudocode illustrates a behavioral search. Field names must be mapped to the application’s actual telemetry schema:
CALL_EVENTS
| where event_time > now() - 24h
| summarize
signaling_events = countif(event in (
"offer", "answer", "candidate", "renegotiate", "state_change"
)),
hangup_events = countif(event in ("local_hangup", "call_end")),
media_stop_events = countif(event in ("audio_stopped", "video_stopped")),
last_event = max(event_time)
by device_id, call_id
| where signaling_events > 100
| where hangup_events >= 1
| where media_stop_events == 0
| project device_id, call_id, signaling_events, hangup_events, last_event
For raw application logs, hunt for the combination rather than a single signature:
CALL_ID=<id> ... signaling/state event ...
CALL_ID=<id> ... local hangup ...
CALL_ID=<id> ... no audio/video stopped event within expected teardown window ...
This is a detection heuristic, not a confirmed CVE-specific signature. Queue saturation may also result from malformed software behavior, network retries, or benign call instability. Validate suspected cases against the deployed RingRTC version and preserve timestamps, peer direction, event counts, and teardown results for engineering review.
Response and Verification Checklist
Use the following checklist when assessing production exposure:
- Identify every application that bundles or links RingRTC.
- Determine the exact RingRTC version in each deployed artifact.
- Treat versions before 2.72.0 as affected unless a backported fix is documented.
- Upgrade to RingRTC 2.72.0 or later.
- Rebuild and redeploy downstream applications as necessary.
- Inspect package contents, native libraries, lockfiles, or SBOMs to confirm the deployed version.
- Test local hangup behavior with internal and external calling scenarios.
- Monitor for calls where media remains active after teardown.
- Document any temporary restrictions on inbound calls or untrusted peers.
- Reassess exposure after each downstream Signal or application update.
References and Further Reading
The primary reference is the NVD record for CVE-2026-113380. It identifies RingRTC versions before 2.72.0 as affected and describes the queue-saturation condition that can interfere with local hangup processing. Because the NVD record reviewed for this assessment does not include a CVSS vector, read it alongside the upstream source changes rather than treating it as a complete implementation analysis.
The Signal RingRTC repository provides the relevant remediation context. Review the fixed commit and the version comparison before updating downstream products, especially when RingRTC is vendored or statically linked.
| Resource | Purpose |
|---|---|
| NVD: CVE-2026-113380 | Vulnerability record and affected-version description |
| Signal RingRTC fix commit | Upstream remediation change |
| RingRTC 2.71.0 to 2.72.0 comparison | Source changes associated with the fixed release |
| Signal RingRTC repository | Project source and integration context |
| RingRTC Android source tree | Android integration reference |
RingRTC versions before 2.72.0 should be considered vulnerable, and downstream applications must verify the version actually shipped in production. No confirmed public proof of concept or in-the-wild exploitation was identified, but the remote-call exposure and high reported CVSS score justify upgrading without waiting for active exploitation.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.