CVE-2026-8931

Vulnerability

A critical remote code execution (RCE) vulnerability exists in Disig Web Signer versions 2.0.3 through 2.5.3. The flaw affects the application across Windows, macOS, and Linux operating systems and was identified by security researcher Marek Alakša from Binary House [1], [2].

Exploitation

Specific exploitation vectors have not been publicly disclosed. Users are advised that the vulnerability exists within the core application logic, and successful exploitation typically requires the application to be running on the host system [1], [2].

Impact

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the host machine. This grants the attacker the ability to execute arbitrary commands with the privileges of the user running the Web Signer application, potentially leading to full system compromise [1], [2].

Mitigation

Disig has addressed this vulnerability in Web Signer version 2.5.5, released on May 11, 2026 [1], [3]. Users are strongly urged to update immediately by selecting the "Check for updates" option in the application's system tray menu or by downloading the latest installer from the official Disig website [2], [4].