Overview
A high-severity vulnerability has been disclosed in DigiDoc, the digital signature software suite built around the open-source libdigidocpp library that underpins Estonia's e-ID digital signing ecosystem and is used across the DigiDoc4 desktop client and the DigiDoc Android and iOS mobile apps. Tracked as CVE-2026-103902 with a CVSS 3.1 score of 7.5 (High), the flaw is an improper verification of cryptographic signature bug (CWE-347) that allows an attacker to craft a forged digital signature that affected DigiDoc software will display and treat as valid.
Because DigiDoc is used to produce and verify legally binding digitally signed documents — including government, financial, and business filings — a verifier trusting a forged-but-displayed-as-valid signature has clear implications for document integrity and non-repudiation.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-103902 |
| Severity | High (CVSS 3.1: 7.5) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| CWE | CWE-347 — Improper Verification of Cryptographic Signature |
| Attack Vector | Network |
| Authentication | None Required |
| Privileges Required | None |
| User Interaction | None |
| Impact | Integrity only — forged signatures accepted as valid |
| Assigner | ENISA |
| Reserved / Published | Reserved October 1, 2026 — Published October 12, 2026 |
Affected Versions
| Component | Vulnerable Range | Fixed Version |
|---|---|---|
| libdigidocpp | ≥ 4.0.0, ≤ 4.4.x | 4.5.0 |
| DigiDoc4 | ≥ 4.6.0, ≤ 4.10.x | 4.11.0 |
| DigiDoc Android | ≥ 2.7.0, ≤ 3.0.x | 3.1.0 |
| DigiDoc iOS | ≥ 2.7.0, ≤ 3.0.x | 3.1.0 |
How It Works
The CVSS vector shows an attack requiring no privileges, no user interaction, and no authentication, reachable over the network, with an impact limited to integrity (data can be tampered with or forged) rather than confidentiality or availability. In practice, this means the signature-verification logic in libdigidocpp — the shared core consumed by DigiDoc4 and the mobile apps — fails to fully validate a signature's cryptographic chain in some scenario, letting a maliciously crafted signature pass the check and render as "valid" in the DigiDoc UI even though it was never produced by the claimed signer's private key or certificate.
The vendor has not published a detailed root-cause write-up alongside the advisory; the fix landed via a patch to the libdigidocpp codebase (GitHub PR #735), with downstream releases of DigiDoc4, DigiDoc Android, and DigiDoc iOS bundling the corrected library.
Impact Assessment
Who Is At Risk
- Anyone verifying digitally signed documents with an affected version of DigiDoc4, DigiDoc Android, or DigiDoc iOS, or any third-party application linking an unpatched
libdigidocpp - Organizations in Estonia and the broader Baltic e-ID ecosystem that accept DigiDoc-signed containers (
.bdoc/.asice) as legally binding proof of signing for contracts, government filings, or financial transactions - Software vendors who embed
libdigidocppin their own document-management or e-government tooling
Potential Attack Chains
- Craft — An attacker constructs a digitally signed document container designed to exploit the verification gap
- Deliver — The forged container is sent to a victim or submitted into a workflow that relies on DigiDoc for signature validation
- False Trust — The victim's DigiDoc software displays the forged signature as valid, incorrectly attributing the document to a legitimate signer
- Downstream Reliance — Business, legal, or government processes proceed on the assumption the document was genuinely signed by the named party
No public proof-of-concept or in-the-wild exploitation has been reported as of publication, and the vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog.
Mitigation
Immediate Actions
- Upgrade
libdigidocppto 4.5.0+, DigiDoc4 to 4.11.0+, and the DigiDoc Android/iOS apps to 3.1.0+ - Any in-house or third-party software that links
libdigidocppdirectly should rebuild against the patched release rather than relying on an app-store update alone - Treat signature verifications performed by pre-patch DigiDoc software as unreliable and consider re-verifying high-value documents once upgraded
Detection Opportunities
- Review document-management or e-government workflows for a backlog of DigiDoc-verified documents accepted during the vulnerable window and spot-check signer provenance where feasible
- Monitor for unusual volumes of newly submitted signed documents around the disclosure date, which could indicate opportunistic forgery attempts
Defence-in-Depth
- Where DigiDoc verification backs a high-value approval step (contracts, financial transfers, government filings), pair it with an independent integrity check rather than relying on a single signature-verification path
- Subscribe to id.ee advisories for the Estonian e-ID ecosystem to stay current on future libdigidocpp security releases
Discovery & Disclosure
CVE-2026-103902 was assigned by ENISA and published on October 12, 2026. It is a distinct issue from the earlier CVE-2026-59112, which separately affected libdigidocpp 4.1.0–4.2.0 due to incorrect exception handling during B-level XAdES signature validation — defenders running libdigidocpp should confirm they are patched against both.