CVE-2026-59112

Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1.

CVSS

No CVSS.

References

Link	Resource
https://github.com/open-eid/libdigidocpp/pull/690
https://www.id.ee/en/article/ria-soovitab-kasutajatel-uuendada-id-tarkvara-eng/
https://www.ria.ee/blogi/digidoc-rakendustes-esinenud-turvanorkus-mis-juhtus-ja-kuidas-see-parandati
https://github.com/open-eid/libdigidocpp/pull/690

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-10 14:17

Updated : 2026-09-01 21:07

NVD link : CVE-2026-59112

Mitre link : CVE-2026-59112

CVE.ORG link : CVE-2026-59112

JSON object : View

Products Affected

No product.

CWE

CWE-347

Improper Verification of Cryptographic Signature

CWE-754

Improper Check for Unusual or Exceptional Conditions

{"id": "CVE-2026-59112", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59112", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T17:55:03.112154Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "affectedData": [{"vendor": "Estonian Information System Authority (RIA)", "product": "libdigidocpp", "versions": [{"status": "affected", "version": "4.1.0", "lessThan": "4.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Estonian Information System Authority (RIA)", "product": "DigiDoc4", "versions": [{"status": "affected", "version": "4.7.0", "lessThan": "4.8.2", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Estonian Information System Authority (RIA)", "product": "DigiDoc", "versions": [{"status": "affected", "version": "2.7.0", "lessThan": "2.7.2", "versionType": "semver"}], "platforms": ["Android"], "defaultStatus": "unaffected"}, {"vendor": "Estonian Information System Authority (RIA)", "product": "DigiDoc", "versions": [{"status": "affected", "version": "2.8.0", "lessThan": "2.8.1", "versionType": "semver"}], "platforms": ["iOS"], "defaultStatus": "unaffected"}]}], "published": "2026-08-10T14:17:25.153", "references": [{"url": "https://github.com/open-eid/libdigidocpp/pull/690", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}, {"url": "https://www.id.ee/en/article/ria-soovitab-kasutajatel-uuendada-id-tarkvara-eng/", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}, {"url": "https://www.ria.ee/blogi/digidoc-rakendustes-esinenud-turvanorkus-mis-juhtus-ja-kuidas-see-parandati", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}, {"url": "https://github.com/open-eid/libdigidocpp/pull/690", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "description": [{"lang": "en", "value": "CWE-347"}, {"lang": "en", "value": "CWE-754"}]}], "descriptions": [{"lang": "en", "value": "Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS.\u00a0This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1."}], "lastModified": "2026-09-01T21:07:58.980", "sourceIdentifier": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}