CVE-2026-59112

Signature validation vulnerability affecting DigiDoc applications

4.4 Medium

Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Active

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.12%Unchanged since Aug 11, 2026

What each source reports

CVE List Score used 4.4

Signature validation vulnerability affecting DigiDoc applications

Record: CVE-2026-59112
CVSS 4.0: 4.4 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Weakness: CWE-347, CWE-754
Updated: 2026-11-02

EUVDEUVD-2026-55632 4.4

Record: EUVD-2026-55632
CVSS 4.0: 4.4 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Updated: 2026-11-02

GitHub AdvisoriesGHSA-cwph-2586-4qwc 4.4

Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional...

Record: GHSA-cwph-2586-4qwc
CVSS 4.0: 4.4 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-347
Updated: 2026-11-02

NVD 4.4

Record: CVE-2026-59112
CVSS 4.0: 4.4 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-347, CWE-754
Updated: 2026-11-02

OSV 4.4

Record: CVE-2026-59112
CVSS 4.0: 4.4 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-59112 4.4

Record: UBUNTU-CVE-2026-59112
CVSS 4.0: 4.4 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libdigidoc` Ubuntu:16.04:LTS	All versions, plus listed versions 2.7.0-0ubuntu43.10.1.1208+ds1-13.10.1.1208+ds1-2	None known
`libdigidoc` Ubuntu:18.04:LTS	All versions, plus listed versions 3.10.1.1208+ds1-2.1	None known
`libdigidoc` Ubuntu:20.04:LTS	All versions, plus listed versions 3.10.4+ds1-2	None known
`libdigidoc` Ubuntu:24.04:LTS	All versions, plus listed versions 3.10.5-43.10.5-4.1build13.10.5-4.1ubuntu2	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-59112 is a medium vulnerability (CVSS 4.4) in Estonian Information System Authority (ria) Digidoc, published August 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 1st percentile. No source names a fixed version.