CVE-2026-113380CWE-754

CVE-2026-113380

published October 20, 2026

CVSS
9.3
EPSS
0%
Percentile
23.9
In the wild
Unconfirmed
What it is

In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:N/SA:N/S:P
EPSS
0.00321 · 23.9th percentile
Weakness
CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published
2026-10-20T09:16Z
References (3)
https://github.com/signalapp/ringrtc/commit/4b1b6fa53c9f30c87c8ea78e44675d4a13e1e4d3 · [email protected]https://github.com/signalapp/ringrtc/compare/v2.71.0...v2.72.0 · [email protected]https://github.com/Imahian/Notes/tree/main/docs/CVEs/CVE-2026-113380 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 20 OCT 04:25Z
    In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call…
    cvelistv5
  • 20 OCT 04:25Z
    In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call…
    cvelistv5