Signal patched high severity RingRTC calling library flaw in September

Signal resolved a severe vulnerability in its calling library on September 4, 2026, 46 days before the flaw was publicly disclosed, shattered.io reported. The security issue allowed a malicious remote peer to prevent a call from terminating by flooding the session with events. [1]

The security flaw, identified as CVE-2026-113380, received a CVSS 4.0 score of 9.3 after MITRE published the official record on October 20, 2026. Help Net Security reported that the vulnerability impacts RingRTC versions prior to version 2.72.0, which contained the original fix. [1]

The Common Vulnerability Scoring System provides a standardized framework for rating computer security vulnerabilities on a scale from 0 to 10 based on ease and impact of exploitation. The rating for this flaw puts it in the critical severity category. [1][4]

Alongside the vulnerability disclosure, Signal continues to fight against Canada's proposed Bill C-22 lawful access legislation. Leadership at the organization stated that the messaging service would choose to exit the Canadian market rather than comply with requirements to collect additional user metadata. [1]