External risk intelligence

RingRTC Call Hangup Interference Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-113380

The vulnerability exists within the RingRTC client-side library used by the Signal application. It relates to call state machine management during peer-to-peer communication. As a client-side component, it lacks the public-facing listener or service-level exposure characteristic of internet-facing infrastructure, making it inherently unlikely to be a reachable public attack surface.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the RingRTC library used by Signal, which could allow a malicious peer to interfere with the normal disconnection of a call. This could potentially disrupt the call's audio and video streams, even when a user attempts to end the call. The primary concern is to determine if our environment is affected by this library.

Call disconnection can be disrupted by peers.
This affects communication platforms and user experience.
Confirm if our Signal usage is exposed.

Attack Path

How an attacker could exploit the issue

A remote attacker can interfere with call management within the Signal application by overwhelming the call's FSM queue. This interference can prevent a local hang-up from successfully ending an active call, potentially leaving audio and video streams active.

No authentication or user interaction needed.
Saturate call FSM queue.
Interfere with call teardown.

Live Threat

Current exploitation, exposure, and threat context

When a malicious peer saturates a call's FSM queue, it could prevent a local hangup from terminating the call, potentially affecting the call's audio and video tracks.

Call audio and video tracks at risk.
Peer can interfere with hangup functionality.
Disrupts call termination.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides in the RingRTC library, which is part of the Signal application's client-side implementation. Real-world ownership likely falls to the Signal application teams and potentially the platform teams responsible for integrating client libraries. The immediate practical step is to confirm the presence of the affected Signal client versions within the organization, assess their reachability and criticality, and then engage with the Signal application owners to plan for updates or risk mitigation.

Signal application and platform teams own this.
Verify Signal client version and reachability.
Plan for Signal client updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the RingRTC library used in Signal?

RingRTC is a specialized software library that manages peer-to-peer real-time communication, such as audio and video calling, specifically for the Signal messaging application. It handles the complex tasks of establishing connections, maintaining media streams, and managing the state of calls between users.

What does CVE-2026-113380 mean for call handling?

This vulnerability, classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions), relates to how the software processes call instructions. It means a malicious peer can intentionally overwhelm the system's call state machine, effectively blocking the software from processing a user's command to end a call, which keeps the connection active.

How can a peer trigger this call termination bug?

An attacker triggers this by flooding a call's Finite State Machine (FSM) queue with excessive data. Notably, this does not happen during normal, legitimate communication; the bug only manifests when a peer actively attempts to saturate these specific internal processing queues to block teardown signals.

Is this CVE-2026-113380 a risk for internet-facing servers?

No. According to Halo Surface Signal, this vulnerability exists within a client-side library, not server infrastructure. It lacks the public-facing listener or service-level exposure typically associated with internet-facing systems, making it highly unlikely to be reachable as a broad network attack surface.

What should I do if I use Signal?

You should verify which version of the Signal application is currently deployed in your environment. Since the fix is contained in version 2.72.0 of the RingRTC library, ensure your applications are updated to the latest available releases provided by the official Signal distribution channels to incorporate this library patch.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.