CVE-2026-4603

CVE-2026-4603 is a medium-severity division by zero vulnerability affecting jsrsasign package versions prior to 11.1.1. An attacker can exploit this locally with low complexity and privileges by providing a malformed JSON Web Key (JWK), which forces RSA public-key operations to produce deterministic zero outputs and hide "invalid key" errors. This could lead to low impacts on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, no public exploit code, and minimal community discussion or media coverage, with its EPSS score indicating a very low likelihood of exploitation.