CVE-2026-57916 Overview
CVE-2026-57916 affects proCertum SmartSign, a document signing application from Certum. The application opens Certificate Practice Statement (CPS) Uniform Resource Identifiers (URIs) embedded in signing certificates without validating the URI schema. An attacker can craft a certificate whose CPS URI points to a local executable or arbitrary URL, sign a document with that certificate, and deliver it to a victim. When the victim opens the document in proCertum SmartSign, the referenced file executes or the URL loads without user consent for the target action. Certum addressed the flaw in proCertum SmartSign version 9.4.3.90. The weakness is classified under CWE-73: External Control of File Name or Path.
Critical Impact
A malicious signed document can trigger execution of an attacker-controlled local file or navigation to an arbitrary URL when the victim opens it in proCertum SmartSign.
Affected Products
- proCertum SmartSign versions prior to 9.4.3.90
- Certum document signing workflows relying on CPS URI rendering
- Any environment where users open third-party signed documents in proCertum SmartSign
Discovery Timeline
- 2026-07-27 - CVE-2026-57916 published to the National Vulnerability Database
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-57916
Vulnerability Analysis
proCertum SmartSign renders Certificate Practice Statement URIs from X.509 certificate policy extensions as clickable or auto-followed references. The application does not restrict the URI schema to safe values such as https or http. An attacker who controls certificate issuance can populate the CPS URI field with file:// paths, UNC paths, or other schemas that resolve to executables. When the victim opens a document signed with the malicious certificate and interacts with the certificate information view, the application dispatches the URI through the operating system handler. The handler resolves the target and launches the executable or opens the referenced resource. Exploitation requires local user interaction with the document, which is reflected in the medium CVSS 4.0 rating.
Root Cause
The root cause is missing schema validation on data drawn from the CPS URI field of the certificate's certificatePolicies extension. proCertum SmartSign trusts the URI as web-safe and hands it to the shell or default handler without an allowlist. This maps to [CWE-73], where external input controls a path used by the application.
Attack Vector
The attacker generates a certificate containing a crafted CPS URI, signs an arbitrary document with that certificate, and delivers the signed document through email, file share, or web download. When the victim opens the document in proCertum SmartSign and views the signer or certificate details, the application activates the URI. The referenced local file executes with the victim's privileges, or a browser opens the attacker-controlled URL. Full technical detail is available in the CERT Polska advisory.
No public exploitation code is bundled with this article. Refer to the CERT.pl proof-of-concept post for reproduction steps.
Detection Methods for CVE-2026-57916
Indicators of Compromise
- Signed documents whose signer certificate contains a CPS URI with a non-http(s) schema such as file://, \\server\share, or custom protocol handlers
- proCertum SmartSign processes spawning child processes such as cmd.exe, powershell.exe, rundll32.exe, or other interpreters shortly after a document open event
- Outbound network connections from proCertum SmartSign to previously unseen or attacker-controlled domains that coincide with document open events
Detection Strategies
- Inspect certificates used to sign inbound documents and flag any whose certificatePolicies CPS URI does not match a corporate allowlist
- Deploy endpoint detection rules that alert on SmartSign.exe (or the installed binary name) creating a process outside its normal child-process baseline
- Correlate document-open telemetry with process creation and network egress events to catch schema-abuse chains
Monitoring Recommendations
- Log full command lines and parent-child process relationships on endpoints running proCertum SmartSign
- Monitor Sysmon Event ID 1 and 3 for anomalous activity attributed to the signing application
- Track installed proCertum SmartSign versions across the fleet and alert on any host running a build below 9.4.3.90
How to Mitigate CVE-2026-57916
Immediate Actions Required
- Upgrade proCertum SmartSign to version 9.4.3.90 or later on every workstation that processes signed documents
- Instruct users to avoid opening signed documents from untrusted senders until the update is deployed
- Audit certificate trust stores and remove issuers that permit arbitrary CPS URI content in issued certificates
Patch Information
Certum resolved CVE-2026-57916 in proCertum SmartSign version 9.4.3.90. Download links and release notes are published on the Certum proCertum SmartSign support page. Verify the installed version through the application's About dialog after upgrade.
Workarounds
- Restrict execution of proCertum SmartSign to a dedicated, non-privileged user context to limit the impact of any file executed through the CPS URI handler
- Apply application allowlisting to prevent proCertum SmartSign from spawning shell, script, or LOLBin child processes
- Block outbound SMB and unusual protocol handlers at the endpoint firewall so file:// and UNC references cannot resolve to attacker-controlled hosts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
