Procertum Smartsign CVE-2026-57916

We are tasked with synthesizing data about CVE-2026-57916 into a comprehensive analysis. We must follow all rules strictly.

First, gather data from the input:

• CVE ID: CVE-2026-57916
• Description: proCertum SmartSign opens Certificate Practice Statement (CPS) URI without schema validation. An attacker can prepare arbitrary certificate with CPS URI pointing to a local executable file or any URL, sign a document with it, and send it to the victim. When the victim opens the document in the application, the specified file will be executed (or webpage will be opened). This issue was fixed in version 9.4.3.90.
• CVSS Score: 4.6
• CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
• CWE: CWE-73 External Control of File Name or Path
• Reported by: CERT-PL
• CPE: cpe:2.3:a:asseco:procertum_smartsign:*:*:*:*:*:*:*:*
• Tags: Information Disclosure, Procertum Smartsign (likely a typo, should be proCertum SmartSign)
• References:
• cert.pl/posts/2026/07/CVE-2026-57916
• pomoc.certum.pl/pl/oprogramowanie/procertum-smartsign/

Now, we have to synthesize. Note: There is no KEV status, no EPSS, no POC mention. So we'll use standard phrases.

Let's construct each field.

product_name: "proCertum SmartSign" - the specific product. Use 1-3 words.

summary: Need to start with impact verb and product. "proCertum SmartSign allows arbitrary file execution via CPS URI due to missing schema validation." Possible summary: "proCertum SmartSign before 9.4.3.90 fails to validate the schema of Certificate Practice Statement (CPS) URIs, allowing a document recipient to be tricked into executing a local executable or opening a malicious webpage when viewing a specially crafted signed document. No authentication required; user interaction is needed to open the document." The attack vector is local? CVSS says AV:L, meaning local, but description suggests sending document to victim, so the execution occurs when victim opens it. The CVSS 4.0 has UI:A (Active), meaning