Signal RingRTC: Unauthenticated call termination denial-of-service (CVE-2026-113380)

CVE-2026-113380 is a critical-severity vulnerability (CVSS 9.3) in the RingRTC library, which provides voice and video calling capabilities for Signal. An attacker can exploit this flaw by flooding the call’s Finite State Machine (FSM) event queue with junk data. Because the application processes hang-up commands as standard FSM events without priority or rate limiting, the legitimate termination signal becomes blocked behind the attacker's traffic. This prevents the application from tearing down audio and video tracks after a user attempts to end a call. The issue was resolved in RingRTC version 2.72.0.

Attack Chain

1. Attacker initiates a voice or video call with the target.
2. Attacker transmits high-frequency junk traffic to the target peer.
3. Junk traffic fills the target application’s FSM event queue.
4. Victim attempts to terminate the call via the user interface.
5. The termination request is placed in the FSM event queue behind the existing junk traffic.
6. The target device fails to process the hang-up event in a timely manner.
7. Audio and video capture remains active on the victim’s device while the call state persists.

Impact

Successful exploitation allows a malicious caller to maintain unauthorized access to a victim's microphone and camera after the victim believes the call has concluded.

Recommendation

• Update Signal applications to the latest available version to incorporate RingRTC 2.72.0 or higher.
• In the absence of an immediate update, users should manually verify that the call indicator disappears and the application reflects an inactive state after ending a call.