CVE-2026-103902
Description
A flaw was found in libdigidocpp. A remote attacker can create forged digital signatures that are improperly verified and incorrectly displayed as valid. This flaw allows an attacker to bypass signature validation checks and present fraudulent or altered documents as authentic.
Statement
This vulnerability is rated as an Important severity because it enables unauthenticated remote actors to generate forged digital signatures that pass verification checks, directly undermining the integrity and authenticity of signed documents. The affected library, libdigidocpp, is not included or supported in Red Hat Enterprise Linux products and is only distributed through community channels such as Fedora. Systems and applications consuming this library are vulnerable whenever validating untrusted signature containers.
Understanding the Weakness (CWE)
Access Control,Integrity,Confidentiality
Technical Impact: Gain Privileges or Assume Identity; Modify Application Data; Execute Unauthorized Code or Commands
An attacker could gain access to sensitive data and possibly execute unauthorized code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
