CVE-2026-113380
9.3CriticalPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-754
Impact
A remote peer can keep transmitting or receiving audio and potentially video tracks after you hang up, causing unauthorized eavesdropping. The attacker only needs to establish an active call with the victim and saturate the call's state machine.
Root cause
Improper check condition handling allows a saturated FSM queue to block and prevent the local hangup signal from tearing down active media tracks.
Affected systems
RingRTC library before 2.72.0 for Signal.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade the RingRTC dependency to version 2.72.0 or later. No interim configuration mitigation is documented; terminate the client process completely if a call fails to drop.
$ cargo update -p ringrtc --precise 2.72.0AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.