PT-2026-28087 · Signify · Signify

Published 2026-03-25 · Updated 2026-03-25 · CVE-2025-70887

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Signify versions prior to 0.9.2

Description An issue exists in Signify that allows a remote attacker to escalate privileges. This is due to problems in the signed data.py and context.py components.

Recommendations Update to version 0.9.2 or later.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-70887

GHSA-P4HH-MQ57-GQ8X

Affected Products

Signify

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-70887 · Security Note
• https://osv.dev/vulnerability/GHSA-p4hh-mq57-gq8x · Vendor Advisory
• https://github.com/mtrojnar/osslsigncode/pull/477 · Note
• https://github.com/mtrojnar/osslsigncode/releases/tag/2.11 · Note
• https://github.com/mtrojnar/osslsigncode/issues/475 · Note
• https://github.com/ralphje/signify/commit/64f21c0cc06cea0536370686ca3ba7a01e4adaa8 · Note
• https://github.com/ralphje/signify/issues/60 · Note
• https://github.com/ralphje/signify · Note