Signal resolved a critical vulnerability in RingRTC, an open-source library used for voice and video calls, which allowed attackers to prevent calls from ending properly.
The vulnerability or weakness
The vulnerability, tracked as CVE-2026-113380 with a CVSS score of 9.3, let malicious callers flood the call's Finite State Machine event queue with junk, preventing the call from terminating.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-113380 | n/a | not scored | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL (2026-10-22)
Users affected
Users of Signal applications should update to the latest version to ensure calls terminate correctly and protect their privacy and security.
Build these skills
Watch the daily brief
Sources
- Signal Vulnerability Lets Malicious Callers Block Hang-Ups (SecurityWeek)
