This vulnerability (CVE-2024-52270) in DropBox Sign (HelloSign) is categorized as CWE-451, involving UI misrepresentation of critical information. The core issue is that the displayed document version does not reflect the fully flattened layers. Upon downloading and printing, the document renders without flattening all layers, enabling content spoofing. This flaw affects DropBox Sign versions up to 2024-12-04. The CVSS 4.0 score is 8.2 (high severity), indicating a local attack vector with low complexity, no privileges required, user interaction needed, and high impact on integrity and system integrity. No known exploits in the wild or vendor patch information is provided.

The vulnerability allows an attacker to spoof content by exploiting the difference between the displayed document and the printed version, potentially misleading users with falsified information. This can undermine trust in document authenticity and integrity. The impact is high on data integrity and system integrity, but exploitation requires local access and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when printing documents from DropBox Sign and verify document authenticity through alternative means. Avoid printing documents from untrusted sources or use PDF flattening tools before printing to mitigate spoofing risks.