DigiDoc’s handling of cryptographic signatures depends on the libdigidocpp, which incorrectly verifies the signature value. The flaw is classified as CWE‑347 and allows an attacker to construct a document containing an invalid signature that the software will display as authentic. If an attacker were able to deliver such a forged document to a user, it would appear that the document had been legitimately signed, giving the attacker full control to insert or modify contents while claiming certification by a trusted source.

The vulnerability is present in DigiDoc products that incorporate libdigidocpp, including DigiDoc4 (versions 4.6.0 through 4.10.9), DigiDoc Android (2.7.0 through 3.0.9) and DigiDoc iOS (2.7.0 through 3.0.9). It also affects the libdigidocpp library itself from 4.0.0 up to 4.4.9. These versions are used in many agencies and commercial applications that rely on verified signatures.

The CVSS score of 7.5 places this vulnerability in the moderate to high severity range. EPSS is not available, and the vulnerability is not currently listed in the CISA KEV catalog, so there is no publicly known exploitation at the time of this assessment. However, because the flaw permits forging signatures, the potential impact on integrity and authenticity is significant. The attack vector is likely local or remote document injection; a user opening a forged document will be misled to believe it has valid authentication. The risk is elevated for any deployment where documents are signed and verified by the affected DigiDoc software.