{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ringrtc--2.72.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:signal:ringrtc:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-113380"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["RingRTC (\u003c 2.72.0)"],"_cs_severities":["medium"],"_cs_tags":["vulnerability","denial-of-service","signal","webrtc"],"_cs_type":"advisory","_cs_vendors":["Signal"],"content_html":"\u003cp\u003eCVE-2026-113380 is a critical-severity vulnerability (CVSS 9.3) in the RingRTC library, which provides voice and video calling capabilities for Signal. An attacker can exploit this flaw by flooding the call’s Finite State Machine (FSM) event queue with junk data. Because the application processes hang-up commands as standard FSM events without priority or rate limiting, the legitimate termination signal becomes blocked behind the attacker's traffic. This prevents the application from tearing down audio and video tracks after a user attempts to end a call. The issue was resolved in RingRTC version 2.72.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker initiates a voice or video call with the target.\u003c/li\u003e\n\u003cli\u003eAttacker transmits high-frequency junk traffic to the target peer.\u003c/li\u003e\n\u003cli\u003eJunk traffic fills the target application’s FSM event queue.\u003c/li\u003e\n\u003cli\u003eVictim attempts to terminate the call via the user interface.\u003c/li\u003e\n\u003cli\u003eThe termination request is placed in the FSM event queue behind the existing junk traffic.\u003c/li\u003e\n\u003cli\u003eThe target device fails to process the hang-up event in a timely manner.\u003c/li\u003e\n\u003cli\u003eAudio and video capture remains active on the victim’s device while the call state persists.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a malicious caller to maintain unauthorized access to a victim's microphone and camera after the victim believes the call has concluded.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Signal applications to the latest available version to incorporate RingRTC 2.72.0 or higher.\u003c/li\u003e\n\u003cli\u003eIn the absence of an immediate update, users should manually verify that the call indicator disappears and the application reflects an inactive state after ending a call.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T12:49:13Z","date_published":"2026-10-22T12:49:13Z","id":"https://feed.craftedsignal.io/briefs/2026-10-signal-ringrtc-hangup-vulnerability/","summary":"A critical vulnerability in the RingRTC library used by Signal allows a remote peer to block call termination by flooding the Finite State Machine (FSM) event queue, enabling unauthorized extension of audio and video capture.","title":"Signal RingRTC: Unauthenticated call termination denial-of-service (CVE-2026-113380)","url":"https://feed.craftedsignal.io/briefs/2026-10-signal-ringrtc-hangup-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - RingRTC (\u003c 2.72.0)","version":"https://jsonfeed.org/version/1.1"}