CVE-2026-113380 in RingRTC
Summary
by MITRE • 10/20/2026
In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in the RingRTC library prior to version 2.72.0 for Signal represents a significant reliability issue within real-time communication protocols, specifically affecting the Finite State Machine that governs WebRTC session management. This flaw allows an adversary or malicious peer to disrupt normal call termination procedures by exploiting resource contention mechanisms inherent in the signaling and media handling architecture. The core of this vulnerability lies in how the application manages its internal state transitions during active sessions, particularly when dealing with concurrent events such as incoming data streams and local user commands like hangup requests.
At a technical level, the RingRTC library utilizes a Finite State Machine to track the lifecycle of a call session, including states for connecting, ringing, connected, and disconnecting. When a peer intentionally saturates the FSM queue by flooding it with specific messages or events, they create a bottleneck that delays the processing of subsequent commands. This saturation effectively creates a denial-of-service condition against local control signals. Consequently, when a user attempts to hang up the call, the command is queued behind the saturated operations and experiences significant latency or may be dropped entirely if buffer limits are exceeded. This prevents the immediate teardown of the session, leaving the audio and potentially video tracks active despite the user's intent to end the communication.
The operational impact of this vulnerability extends beyond simple inconvenience; it compromises user privacy and system resource integrity. By preventing a clean call termination, an attacker can force the application to maintain open network sockets and consume CPU cycles for media processing unnecessarily. This leads to increased battery drain on mobile devices and potential bandwidth exhaustion if video streams remain active. Furthermore, in scenarios where users expect immediate disconnection for security reasons, such as ending a sensitive conversation with a compromised peer, this delay exposes them to prolonged risk of eavesdropping or data interception before the session is finally terminated by timeout mechanisms or manual intervention at lower levels of the stack.
This issue aligns closely with CWE-400, which describes uncontrolled resource consumption, and specifically relates to race conditions where timing dependencies allow one process to interfere with another's expected behavior. In terms of the MITRE ATT&CK framework, this vulnerability facilitates Denial-of-Service attacks against real-time communication channels (T1496) by exploiting application-level logic flaws rather than network-layer vulnerabilities. It highlights a critical gap in input validation and queue management within high-throughput signaling environments where message ordering and processing speed are paramount for maintaining session integrity.
Mitigation strategies must focus on hardening the FSM implementation to prioritize control-plane messages over data-plane events during state transitions. Implementing priority queues that ensure hangup commands bypass standard event loops is essential, as is introducing timeouts or circuit breakers that forcibly terminate sessions if queue depth exceeds safe thresholds. Upgrading to RingRTC version 2.72.0 or later resolves this issue by addressing the underlying race condition and improving the robustness of session teardown procedures against adversarial input patterns. Developers should also consider implementing rate limiting on incoming signaling messages from peers to prevent any single entity from monopolizing processing resources, thereby ensuring that local user commands retain their intended precedence in the application logic flow.