What’s Vulnerable › Vulnerabilities

CVE-2026-103902: DigiDoc improper signature verification

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-16
• Weakness: CWE-347

Description

Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures that are displayed a valid by affected DigiDoc software.This issue affects libdigidocpp: from 4.0.0 before 4.5.0; DigiDoc4: from 4.6.0 before 4.11.0; DigiDoc Android: from 2.7.0 before 3.1.0; DigiDoc iOS: from 2.7.0 before 3.1.0.

Affected products

• DigiDoc4: from 4.6.0 before 4.11.0 — fixed in 4.11.0
• DigiDoc Android: from 2.7.0 before 3.1.0 — fixed in 3.1.0
• DigiDoc iOS: from 2.7.0 before 3.1.0 — fixed in 3.1.0
• DigiDoc libdigidocpp: from 4.0.0 before 4.5.0 — fixed in 4.5.0

How to fix

Upgrade to a fixed version: DigiDoc4 4.11.0; DigiDoc Android 3.1.0; DigiDoc iOS 3.1.0; DigiDoc libdigidocpp 4.5.0. Check the vendor advisory for mitigations.

References

• https://github.com/open-eid/libdigidocpp/pull/735
• https://www.id.ee/en/article/id-tarkvara-uus-versioon-267-on-avalikustatud/

Get alerted when CVE-2026-103902 or the next vulnerability affects your stack