This vulnerability (CVE-2026-59112) affects the Estonian Information System Authority's libdigidocpp and associated DigiDoc products. It is characterized by improper verification of cryptographic signatures (CWE-347) and improper checks for unusual or exceptional conditions (CWE-754). The flaw could potentially allow an attacker to bypass signature verification mechanisms, undermining the integrity assurances of the affected software. The affected versions are libdigidocpp from 4.1.0 before 4.2.1, DigiDoc4 from 4.7.0 before 4.8.2, DigiDoc on Android from 2.7.0 before 2.7.2, and DigiDoc on iOS from 2.8.0 before 2.8.1. The CVSS 4.0 base score is 4.4, indicating medium severity, with partial attack complexity and required user interaction. No vendor advisory or patch information is currently available, and no exploits are known in the wild.

The vulnerability could allow an attacker to exploit improper cryptographic signature verification, potentially enabling bypass of signature validation or acceptance of forged signatures. This undermines the trustworthiness of digital signatures processed by the affected software, which could impact the integrity and authenticity of signed documents. However, the medium CVSS score and lack of known exploits suggest limited immediate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for vendor updates and avoid using affected versions in high-risk environments. No specific mitigations are provided by the vendor at this time.