CVE-2026-57916 in proCertum SmartSign
Summary
by MITRE • 07/27/2026
proCertum SmartSign opens Certificate Practice Statement (CPS) URI without schema validation. An attacker can prepare arbitrary certificate with CPS URI pointing to a local executable file or any URL, sign a document with it, and send it to the victim. When the victim opens the document in the application, the specified file will be executed (or webpage will be opened).
This issue was fixed in version 9.4.3.90.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/27/2026
The proCertum SmartSign vulnerability represents a critical security flaw in certificate handling that enables arbitrary code execution through manipulated Certificate Practice Statement URIs. This weakness allows attackers to craft malicious certificates containing CPS URIs that point to local executable files or web resources, creating a sophisticated attack vector for social engineering and remote code execution. The vulnerability exists in the application's URI parsing mechanism which fails to validate the schema of the specified URI before attempting to access the referenced resource.
The technical implementation of this flaw stems from insufficient input validation within the certificate processing pipeline where the CPS URI field is treated as a trusted reference without proper schema verification. When a victim opens a document signed with a malicious certificate, the application automatically attempts to resolve and execute the URI specified in the CPS field without validating whether it represents a legitimate web resource or a local file system path. This behavior creates an execution environment where attackers can specify any valid URI scheme including file:// protocols that would directly execute local binaries or open arbitrary web pages.
The operational impact of this vulnerability extends beyond simple code execution to encompass comprehensive attack surface expansion for threat actors. Victims are typically deceived into opening documents that appear legitimate, making this a prime candidate for phishing campaigns and targeted attacks against specific organizations. The attack chain begins with certificate preparation where malicious actors craft certificates with carefully crafted CPS URIs, followed by document signing and delivery to victims who unknowingly trigger the execution when opening the signed content. This vulnerability directly aligns with attack patterns described in the ATT&CK framework under initial access and execution phases, specifically targeting user interaction as the primary attack vector.
Security controls for this vulnerability should include implementing strict URI schema validation that prevents file:// or other potentially dangerous protocols from being executed without explicit user confirmation. The fix implemented in version 9.4.3.90 demonstrates proper input sanitization by validating URI schemes and ensuring only safe web protocols are processed automatically. Organizations should also implement certificate trust policies that restrict the acceptance of certificates with suspicious CPS URIs and establish monitoring procedures to detect unusual certificate usage patterns. This vulnerability maps to CWE-20, which addresses improper input validation, and represents a classic example of how insufficient validation in security-critical components can lead to remote code execution through seemingly benign certificate fields. The remediation approach emphasizes the importance of proper URI handling and schema validation as fundamental security controls that should be implemented across all certificate processing systems to prevent similar issues from occurring in other applications.