PT-2026-28087 · Signify · Signify

CVE-2025-70887 · Published 2026-03-25 · Updated 2026-03-25

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Signify versions prior to 0.9.2

Description An issue exists in Signify that allows a remote attacker to escalate privileges. This is due to problems in the signed data.py and context.py components.

Recommendations Update to version 0.9.2 or later.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-70887

GHSA-P4HH-MQ57-GQ8X

PYSEC-2026-2278

Affected Products

Signify

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/70xxx/CVE-2025-70887.json · Exploit
• https://github.com/ralphje/signify/commit/64f21c0cc06cea0536370686ca3ba7a01e4adaa8 · Patch
• https://osv.dev/vulnerability/PYSEC-2026-2278 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p4hh-mq57-gq8x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-70887 · Security Note
• https://osv.dev/vulnerability/CVE-2025-70887 · Vendor Advisory
• https://github.com/mtrojnar/osslsigncode/pull/477 · Note
• https://github.com/mtrojnar/osslsigncode/issues/475 · Note
• https://github.com/mtrojnar/osslsigncode/releases/tag/2.11 · Note
• https://github.com/ralphje/signify/issues/60 · Note
• https://github.com/ralphje/signify · Note