All vulnerabilities
CVE-2026-103902

libdigidocpp: DigiDoc improper signature verification

DigiDoc libdigidocpp
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.5.0Also 4.11.0, 3.1.0CVE List
Published12 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures that are displayed a valid by affected DigiDoc software.This issue affects libdigidocpp: from 4.0.0 before 4.5.0; DigiDoc4: from 4.6.0 before 4.11.0; DigiDoc Android: from 2.7.0 before 3.1.0; DigiDoc iOS: from 2.7.0 before 3.1.0.

Text from CVE List

Affected versions 4

  • libdigidocppaffected: 4.0.0 before 4.5.0CVE List
  • DigiDoc4affected: 4.6.0 before 4.11.0CVE List
  • DigiDoc Androidaffected: 2.7.0 before 3.1.0CVE List
  • DigiDoc iOSaffected: 2.7.0 before 3.1.0CVE List

References 2