PT-2026-31646 · Unknown · Osslsigncode

Published 2026-04-09 · Updated 2026-04-09 · CVE-2026-39855

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions osslsigncode versions prior to 2.13

Description osslsigncode is a tool for Authenticode signing and timestamping. An integer underflow exists in versions 2.12 and earlier within the PE page-hash computation code (pe page hash calc()). This occurs when processing PE files where the SizeOfHeaders (hdrsize) is larger than the SectionAlignment (pagesize). The subtraction of hdrsize from pagesize without validation leads to an integer underflow, resulting in a large unsigned length. This causes an out-of-bounds read from the heap during hashing, potentially crashing the process. The issue is triggered when signing malicious PE files with page hashing enabled (-ph) or verifying malicious signed PE files containing page hashes.

Recommendations Update osslsigncode to version 2.13 or later.

Fix

Out of bounds Read

Integer Underflow

Integer Overflow

Weakness Enumeration

CWE-125

CWE-191

CWE-190

Related Identifiers

CVE-2026-39855

Affected Products

Osslsigncode

References · 10

• https://github.com/mtrojnar/osslsigncode/security/advisories/GHSA-76vv-x5rr-q3mr · Vendor Advisory
• https://github.com/mtrojnar/osslsigncode/commit/2a5409b7c4b6c6fad2b093531e8fea6cf08e1568 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39855 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-39855 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-39855 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-39855 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-39855 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-39855 · Vendor Advisory
• https://github.com/mtrojnar/osslsigncode/releases/tag/2.13 · Note
• https://twitter.com/CVEnew/status/2042302802052202667 · Twitter Post