Signal RingRTC CWE-754 Flaw Lets Attackers Flood FSM Queue to Stop A/V Tracks

The Signal RingRTC library contains a critical flaw that disrupts call termination procedures. Versions of the library before 2.72.0 are vulnerable to an issue where a remote peer can saturate the finite state machine queue. This saturation prevents the local application from successfully tearing down the call, leaving audio and potentially video tracks active even after a user attempts to hang up.

Root cause

The underlying weakness is classified as CWE-754 by the National Vulnerability Database. The RingRTC library manages call states through a finite state machine that relies on a queue for processing events. When this queue becomes saturated, the system fails to process the local hangup command correctly. Consequently, the call session does not terminate as expected, maintaining the connection for media streams despite the user's intent to disconnect.

Attack path

An adversary does not need complex exploitation tools to trigger this issue. The attack path involves a remote peer simply sending enough data or signals to fill the call's finite state machine queue. By saturating this queue, the peer interferes with the local hangup mechanism. This allows the attacker to keep the call active, continuing to transmit audio and possibly video, which prevents the victim from ending the session through normal interface controls.

Affected versions

The vulnerability exists in all builds of the Signal RingRTC library that precede version 2.72.0. Any application or service relying on these older versions of the library is exposed to this queue saturation attack. Users and administrators should verify their current library version to determine if they fall within the affected range.

Mitigation

• Upgrade Signal RingRTC to version 2.72.0 or later to resolve the queue saturation issue.
• Audit applications using the RingRTC library to ensure they are not running vulnerable versions.
• Monitor call logs for unexpected session durations that exceed normal hangup timeouts.
• Implement rate limiting on incoming call signals to reduce the risk of queue saturation.

Signals worth monitoring

Security teams should watch for anomalies in call duration metrics that deviate from baseline patterns. Logs showing repeated hangup attempts without successful session termination are a strong indicator of this activity. Check whether media streams remain active after the user interface indicates a call has ended. Look for sudden spikes in queue depth metrics within the signaling protocol logs. Teams usually correlate these signals with specific peer identities to identify the source of the saturation.

What to do and how to stay safe: Signal

• Verify the version of the RingRTC library in your current Signal installation or integrated application.
• Update to the latest available version once the vendor provides an update to address CVE-2026-113380.
• Monitor application logs for any calls that fail to terminate or remain active after hangup commands.
• Report any observed queue saturation behaviors to the vendor to assist in future patch development.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-113380?

The National Vulnerability Database rates CVE-2026-113380 as a 9.3, which is classified as critical.

Which versions of Signal RingRTC are vulnerable to this flaw?

All versions of the Signal RingRTC library before 2.72.0 are affected by this queue saturation vulnerability.

How does the attacker exploit this vulnerability?

The attacker saturates the call's finite state machine queue, which interferes with the local hangup process and prevents call teardown.