https://pwn.watch/t/signal Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 16:00:43 GMT https://pwn.watch/i/signal-ringrtc-cve-2026-113380 https://pwn.watch/i/signal-ringrtc-cve-2026-113380 Thu, 22 Oct 2026 16:00:43 GMT critical <p>A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> RingRTC 2.72.0 (update Signal on every device)</p> <p><strong>Latest updates:</strong></p><ul><li>2026-10-22: No known exploitation; CISA has not added it to KEV and NVD lists it as awaiting analysis. (<a href="https://www.helpnetsecurity.com/2026/10/22/signal-ringrtc-vulnerability-cve-2026-113380/">source</a>)</li><li>2026-10-22: SecurityWeek: the hang-up was queued behind peer events with no rate limit or priority; the fix makes call termination bypass the queue. Users should update Signal and check the call indicator after hanging up. (<a href="https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/">source</a>)</li><li>2026-10-22: Closed on pwn.watch: the fix shipped Sep 4 (RingRTC 2.72.0), there is still no known exploitation and no new developments, so this is now a patch-and-move-on item. Make sure Signal is updated on every device. (<a href="https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2026-113380</p>