CVE-2026-59112

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59112", "assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "state": "PUBLISHED", "assignerShortName": "ENISA", "dateReserved": "2026-07-02T15:47:36.965Z", "datePublished": "2026-08-10T13:57:37.159Z", "dateUpdated": "2026-08-10T17:55:30.587Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "shortName": "ENISA", "dateUpdated": "2026-08-10T13:57:37.159Z"}, "title": "Signature validation vulnerability affecting DigiDoc applications", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-347", "description": "CWE-347 Improper verification of cryptographic signature", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-754", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions", "type": "CWE"}]}], "affected": [{"vendor": "Estonian Information System Authority (RIA)", "product": "libdigidocpp", "versions": [{"status": "affected", "version": "4.1.0", "lessThan": "4.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Estonian Information System Authority (RIA)", "product": "DigiDoc4", "versions": [{"status": "affected", "version": "4.7.0", "lessThan": "4.8.2", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Estonian Information System Authority (RIA)", "product": "DigiDoc", "platforms": ["Android"], "versions": [{"status": "affected", "version": "2.7.0", "lessThan": "2.7.2", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Estonian Information System Authority (RIA)", "product": "DigiDoc", "platforms": ["iOS"], "versions": [{"status": "affected", "version": "2.8.0", "lessThan": "2.8.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS.\u00a0This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS.&nbsp;This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1."}]}], "references": [{"url": "https://github.com/open-eid/libdigidocpp/pull/690", "tags": ["patch"]}, {"url": "https://www.id.ee/en/article/ria-soovitab-kasutajatel-uuendada-id-tarkvara-eng/", "tags": ["vendor-advisory"]}, {"url": "https://www.ria.ee/blogi/digidoc-rakendustes-esinenud-turvanorkus-mis-juhtus-ja-kuidas-see-parandati", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.4, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P"}}], "solutions": [{"lang": "en", "value": "Systems integrating libdigidocpp should update to\nversion 4.2.1 or later.\u00a0\nUsers of DigiDoc applications should update to fixed\nversions provided by the vendor:\u00a0\nDigiDoc4 - 4.8.2 or later, RIA DigiDoc Android\n- 2.7.2 or later, and RIA DigiDoc iOS - 2.8.1 or later.\u00a0\nSignatures that were validated\nwith the vulnerable software versions should be revalidated.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span>Systems integrating libdigidocpp should update to\nversion 4.2.1 or later.&nbsp;<br>Users of DigiDoc applications should update to fixed\nversions provided by the vendor:&nbsp;<br>DigiDoc4 - 4.8.2 or later, RIA DigiDoc Android\n- 2.7.2 or later, and RIA DigiDoc iOS - 2.8.1 or later.&nbsp;<br>Signatures that were validated\nwith the vulnerable software versions should be revalidated.</span>"}]}], "credits": [{"lang": "en", "value": "Burak Can Kus & Aleksander Kamenik (Cybernetica)", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"references": [{"url": "https://github.com/open-eid/libdigidocpp/pull/690", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-10T17:55:03.112154Z", "id": "CVE-2026-59112", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T17:55:30.587Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59112", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T17:55:03.112154Z"}}}], "references": [{"url": "https://github.com/open-eid/libdigidocpp/pull/690", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T17:55:24.289Z"}}], "cna": {"title": "Signature validation vulnerability affecting DigiDoc applications", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Burak Can Kus & Aleksander Kamenik (Cybernetica)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Estonian Information System Authority (RIA)", "product": "libdigidocpp", "versions": [{"status": "affected", "version": "4.1.0", "lessThan": "4.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Estonian Information System Authority (RIA)", "product": "DigiDoc4", "versions": [{"status": "affected", "version": "4.7.0", "lessThan": "4.8.2", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Estonian Information System Authority (RIA)", "product": "DigiDoc", "versions": [{"status": "affected", "version": "2.7.0", "lessThan": "2.7.2", "versionType": "semver"}], "platforms": ["Android"], "defaultStatus": "unaffected"}, {"vendor": "Estonian Information System Authority (RIA)", "product": "DigiDoc", "versions": [{"status": "affected", "version": "2.8.0", "lessThan": "2.8.1", "versionType": "semver"}], "platforms": ["iOS"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Systems integrating libdigidocpp should update to\nversion 4.2.1 or later.\u00a0\nUsers of DigiDoc applications should update to fixed\nversions provided by the vendor:\u00a0\nDigiDoc4 - 4.8.2 or later, RIA DigiDoc Android\n- 2.7.2 or later, and RIA DigiDoc iOS - 2.8.1 or later.\u00a0\nSignatures that were validated\nwith the vulnerable software versions should be revalidated.", "supportingMedia": [{"type": "text/html", "value": "<span>Systems integrating libdigidocpp should update to\nversion 4.2.1 or later.&nbsp;<br>Users of DigiDoc applications should update to fixed\nversions provided by the vendor:&nbsp;<br>DigiDoc4 - 4.8.2 or later, RIA DigiDoc Android\n- 2.7.2 or later, and RIA DigiDoc iOS - 2.8.1 or later.&nbsp;<br>Signatures that were validated\nwith the vulnerable software versions should be revalidated.</span>", "base64": false}]}], "references": [{"url": "https://github.com/open-eid/libdigidocpp/pull/690", "tags": ["patch"]}, {"url": "https://www.id.ee/en/article/ria-soovitab-kasutajatel-uuendada-id-tarkvara-eng/", "tags": ["vendor-advisory"]}, {"url": "https://www.ria.ee/blogi/digidoc-rakendustes-esinenud-turvanorkus-mis-juhtus-ja-kuidas-see-parandati", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS.\u00a0This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1.", "supportingMedia": [{"type": "text/html", "value": "Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS.&nbsp;This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347 Improper verification of cryptographic signature"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-754", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions"}]}], "providerMetadata": {"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "shortName": "ENISA", "dateUpdated": "2026-08-10T13:57:37.159Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59112", "state": "PUBLISHED", "dateUpdated": "2026-08-10T17:55:30.587Z", "dateReserved": "2026-07-02T15:47:36.965Z", "assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "datePublished": "2026-08-10T13:57:37.159Z", "assignerShortName": "ENISA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "libdigidocpp", "vendor": "Estonian Information System Authority (RIA)", "versions": [{"lessThan": "4.2.1", "status": "affected", "version": "4.1.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "DigiDoc4", "vendor": "Estonian Information System Authority (RIA)", "versions": [{"lessThan": "4.8.2", "status": "affected", "version": "4.7.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "platforms": ["Android"], "product": "DigiDoc", "vendor": "Estonian Information System Authority (RIA)", "versions": [{"lessThan": "2.7.2", "status": "affected", "version": "2.7.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "platforms": ["iOS"], "product": "DigiDoc", "vendor": "Estonian Information System Authority (RIA)", "versions": [{"lessThan": "2.8.1", "status": "affected", "version": "2.8.0", "versionType": "semver"}]}], "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS.\u00a0This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1."}], "id": "CVE-2026-59112", "lastModified": "2026-09-01T21:07:58.980", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59112", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-10T17:55:03.112154Z", "version": "2.0.3"}}]}, "published": "2026-08-10T14:17:25.153", "references": [{"source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "url": "https://github.com/open-eid/libdigidocpp/pull/690"}, {"source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "url": "https://www.id.ee/en/article/ria-soovitab-kasutajatel-uuendada-id-tarkvara-eng/"}, {"source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "url": "https://www.ria.ee/blogi/digidoc-rakendustes-esinenud-turvanorkus-mis-juhtus-ja-kuidas-see-parandati"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/open-eid/libdigidocpp/pull/690"}], "sourceIdentifier": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}, {"lang": "en", "value": "CWE-754"}], "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["android"], "status": "affected", "versions": {"scheme": "semver", "value": "[2.7.0,2.7.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DigiDoc", "source": "cna", "vendor": "Estonian Information System Authority (RIA)"}, "product": "digidoc", "vendor": "estonian_information_system_authority_(ria)"}, {"configurations": [{"platform": ["ios"], "status": "affected", "versions": {"scheme": "semver", "value": "[2.8.0,2.8.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DigiDoc", "source": "cna", "vendor": "Estonian Information System Authority (RIA)"}, "product": "digidoc", "vendor": "estonian_information_system_authority_(ria)"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.7.0,4.8.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DigiDoc4", "source": "cna", "vendor": "Estonian Information System Authority (RIA)"}, "product": "digidoc4", "vendor": "estonian_information_system_authority_(ria)"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.1.0,4.2.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "libdigidocpp", "source": "cna", "vendor": "Estonian Information System Authority (RIA)"}, "product": "libdigidocpp", "vendor": "estonian_information_system_authority_(ria)"}], "created": "2026-08-10T18:45:17.008102+00:00", "updated": "2026-08-11T14:22:41.853563+00:00", "vendors": ["estonian_information_system_authority_(ria)", "estonian_information_system_authority_(ria)$PRODUCT$digidoc", "estonian_information_system_authority_(ria)$PRODUCT$digidoc4", "estonian_information_system_authority_(ria)$PRODUCT$libdigidocpp"]}