PT-2026-31647 · Unknown · Osslsigncode

Published 2026-04-09 · Updated 2026-04-09 · CVE-2026-39856

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions osslsigncode versions prior to 2.13

Description osslsigncode is a tool for Authenticode signing and timestamping. A flaw exists in versions 2.12 and earlier within the PE page-hash computation code (pe page hash calc()). The function utilizes PointerToRawData and SizeOfRawData from section headers without verifying if the referenced region is within the file boundaries. An attacker can create a PE file with section headers that point beyond the file's end. When osslsigncode calculates page hashes for such a file, it may attempt to hash data from an invalid memory region, leading to an out-of-bounds read and potentially crashing the process. This can be triggered during signing a malicious PE file with page hashing enabled (-ph), or when verifying a malicious signed PE file that already contains page hashes.

Recommendations Update osslsigncode to version 2.13 or later.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-39856

Affected Products

Osslsigncode

References · 10

• https://github.com/mtrojnar/osslsigncode/security/advisories/GHSA-rjrx-chvw-8jw8 · Vendor Advisory
• https://github.com/mtrojnar/osslsigncode/commit/92f8761b4770f76a36731969b5040ce3b9a09570 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-39856 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-39856 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39856 · Security Note
• https://ubuntu.com/security/CVE-2026-39856 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-39856 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-39856 · Security Note
• https://github.com/mtrojnar/osslsigncode/releases/tag/2.13 · Note
• https://twitter.com/CVEnew/status/2042302801037181346 · Twitter Post