PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-59112 Estonian Information System Authority (RIA) CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-10T14:17:25.153Z and has not been modified since then. CVE-2026-59112 involves Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions in libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. Affected versions are libdigidocpp from 4.1.0 before 4.2.1, DigiDoc4 from 4.7.0 before 4.8.2, DigiDoc on Android from 2.7.0 before 2.7.2, and DigiDoc on iOS from 2.8.0 before 2.8.1. The CVSS score is 4.4, indicating a medium severity vulnerability. Organizations and users should review the official advisory for detailed impact and remediation guidance.

Vendor
Estonian Information System Authority (RIA)
Product
libdigidocpp
CVSS
MEDIUM 4.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-10
Original CVE updated
2026-09-01
Advisory published
2026-08-10
Advisory updated
2026-09-01

Who should care

Organizations and users of libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS should be aware of this vulnerability and take steps to update to patched versions. This includes operators managing affected deployments, platform administrators, vulnerability management teams, and security teams responsible for reviewing and implementing compensating controls for exposed systems.

Technical summary

CVE-2026-59112 involves Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions in libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. Affected versions are libdigidocpp from 4.1.0 before 4.2.1, DigiDoc4 from 4.7.0 before 4.8.2, DigiDoc on Android from 2.7.0 before 2.7.2, and DigiDoc on iOS from 2.8.0 before 2.8.1. The CVSS score is 4.4, indicating a medium severity vulnerability.

Defensive priority

Organizations using libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS should prioritize updating to patched versions to mitigate the Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerabilities.

Recommended defensive actions

  • Update libdigidocpp to version 4.2.1 or later
  • Update DigiDoc4 to version 4.8.2 or later
  • Update DigiDoc on Android to version 2.7.2 or later
  • Update DigiDoc on iOS to version 2.8.1 or later
  • Review and implement compensating controls for vulnerable systems

Evidence notes

The CVE-2026-59112 record indicates vulnerabilities in libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS, specifically Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions. Affected versions include libdigidocpp from 4.1.0 before 4.2.1, DigiDoc4 from 4.7.0 before 4.8.2, DigiDoc on Android from 2.7.0 before 2.7.2, and DigiDoc on iOS from 2.8.0 before 2.8.1. Limited evidence suggests vendor remediation efforts; however, detailed impact and affected scope remain unclear.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-59112 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-59112

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-59112 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-59112

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/open-eid/libdigidocpp/pull/690

    a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

  • Source reference

    Unverified legacy reference

    URL: https://www.id.ee/en/article/ria-soovitab-kasutajatel-uuendada-id-tarkvara-eng/

    a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

  • Source reference

    Unverified legacy reference

    URL: https://www.ria.ee/blogi/digidoc-rakendustes-esinenud-turvanorkus-mis-juhtus-ja-kuidas-see-parandati

    a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.