PT-2026-118240 · Ringrtc · Ringrtc
CVE-2026-113380
·
Published
2026-10-20
·
Updated
2026-10-22
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
RingRTC versions prior to 2.72.0
Description
An issue exists in the RingRTC library for Signal where a remote peer can saturate the call's Finite State Machine (FSM) event queue with junk events. This saturation prevents the local hang-up event from being processed, allowing the audio track and potentially the video track to continue flowing to the attacker even after the user believes the call has ended.
Recommendations
Update RingRTC to version 2.72.0 or later.
Exploit
Fix
DoS
Improper Check for Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ringrtc