Cyber Posture

CVE-2025-70887

High

Published: 25 March 2026

Published
25 March 2026
Modified
01 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 36.1th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

An issue in ralphje Signify before v.0.9.2 allows a remote attacker to escalate privileges via the signed_data.py and the context.py components

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
preventrecover

Directly mandates timely identification, reporting, and correction of the privilege escalation flaw in Signify by upgrading to v0.9.2 or later.

AC-6 Least Privilege good match
prevent

Enforces least privilege to counter the improper privilege management (CWE-269) that enables low-privileged remote attackers to escalate privileges.

AC-3 Access Enforcement good match
prevent

Requires enforcement of approved access authorizations, addressing the failure in signed_data.py and context.py components to properly restrict privilege escalation.

Security SummaryAI

CVE-2025-70887 is a privilege escalation vulnerability in ralphje's Signify tool prior to version 0.9.2, published on 2026-03-25. The flaw resides in the signed_data.py and context.py components and is classified under CWE-269 (Improper Privilege Management). It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and availability.

A remote attacker possessing low privileges (PR:L) can exploit the vulnerability without user interaction. Exploitation occurs over the network with low complexity, enabling privilege escalation on affected systems running vulnerable versions of Signify.

Mitigation is addressed through updates in the ralphje/signify repository, including the fix in commit 64f21c0cc06cea0536370686ca3ba7a01e4adaa8 and discussion in issue #60; users should upgrade to version 0.9.2 or later. Related concerns in the osslsigncode project are covered in issue #475, pull request #477, and release 2.11.

Details

CWE(s)
CWE-269

Affected Products

ralphje
signify
≤ 0.9.2

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

The vulnerability is a privilege escalation issue (CWE-269) exploitable remotely with low privileges, directly enabling T1068: Exploitation for Privilege Escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References