CVE-2026-59112: Signature validation vulnerability affecting DigiDoc applications
Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RIA libdigidocppto a version that resolves this vulnerability.Fixed in 4.2.1 - Upgrade
Upgrade
DigiDoc4to a version that resolves this vulnerability.Fixed in 4.8.2 - Upgrade
Upgrade
RIA DigiDoc Androidto a version that resolves this vulnerability.Fixed in 2.7.2 - Upgrade
Upgrade
RIA DigiDoc iOSto a version that resolves this vulnerability.Fixed in 2.8.1 - Operational
Revalidate signatures that were validated by DigiDoc applications that were running on vulnerable versions, after updating to the fixed versions.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59112?
The severity of CVE-2026-59112 is rated at 55.
What applications are affected by CVE-2026-59112?
CVE-2026-59112 affects the libdigidocpp, DigiDoc4, and DigiDoc applications on Android and iOS.
How do I fix CVE-2026-59112?
To fix CVE-2026-59112, update libdigidocpp to version 4.2.1 or later, and update DigiDoc4 on all platforms.
What kind of vulnerability is CVE-2026-59112?
CVE-2026-59112 is a signature validation vulnerability caused by improper verification of cryptographic signatures.
Is there a workaround for CVE-2026-59112?
There is no documented workaround for CVE-2026-59112; updating the affected software is the recommended solution.