---
title: Signal RingRTC CVE-2026-113380 (CVSS 4.0: 9.3): a malicious caller could flood the call queue so your hang-up never ends the call | ctxsec
url: https://ctxsec.com/items/signal-ringrtc-cve-2026-113380-hangup-flood
description: ""
status: "confirmed (CVE record and RingRTC fix commit; fixed in RingRTC 2.72.0, Sep 4); details and PoC public since Oct 20"
published: 2026-10-22
---

> 

[← Cybersecurity News](/news) · [markdown](/items/signal-ringrtc-cve-2026-113380-hangup-flood.md)

confirmed (CVE record and RingRTC fix commit; fixed in RingRTC 2.72.0, Sep 4); details and PoC public since Oct 20

2026-10-22

### Signal RingRTC CVE-2026-113380 (CVSS 4.0: 9.3): a malicious caller could flood the call queue so your hang-up never ends the call

In RingRTC before **2.72.0**, the WebRTC-based calling library Signal uses, a remote peer could fill a call's state-machine event queue so a local hang-up stayed stuck behind attacker events. That kept the call, its audio and possibly video, running after the user believed it had ended. Signal fixed it on **Sep 4** by handling termination outside the queue. The CVE record and a researcher write-up with a conceptual PoC went public on Oct 20. Current Signal apps include the fix; update any stale installs, especially desktop clients that don't auto-update.

Sources: [NVD: CVE-2026-113380](https://nvd.nist.gov/vuln/detail/CVE-2026-113380) · [signalapp/ringrtc fix commit](https://github.com/signalapp/ringrtc/commit/4b1b6fa53c9f30c87c8ea78e44675d4a13e1e4d3) · [SecurityWeek (Oct 22)](https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/)