Improper Verification in Estonian Information System Authority Software
CVE-2026-59112

4.4MEDIUM

Key Information:

Vendor

Estonian Information System Authority (ria)

Status
Libdigidocpp
Digidoc4
Digidoc
Vendor
CVE Published:
10 August 2026

What is CVE-2026-59112?

The vulnerability impacts multiple products from the Estonian Information System Authority, including libdigidocpp, DigiDoc4, and its mobile applications for Android and iOS. This issue arises from improper verification of cryptographic signatures and inadequate handling of unusual conditions, which could potentially lead to unauthorized access or manipulation of digital identities. Users are strongly advised to update affected software versions to enhance security and protect sensitive data.

Affected Version(s)

DigiDoc Android 2.7.0 < 2.7.2

DigiDoc iOS 2.8.0 < 2.8.1

DigiDoc4 4.7.0 < 4.8.2

References

https://github.com/open-eid/libdigidocpp/pull/690
patch
https://www.id.ee/en/article/ria-soovitab-kasutajatel-uue...
vendor-advisory
https://www.ria.ee/blogi/digidoc-rakendustes-esinenud-tur...
government-resource

CVSS V4

Score:
4.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Burak Can Kus & Aleksander Kamenik (Cybernetica)
.