CVE-2026-39855

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39855", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-07T19:13:20.378Z", "datePublished": "2026-04-09T15:58:38.559Z", "dateUpdated": "2026-04-09T19:22:16.659Z"}, "containers": {"cna": {"title": "osslsigncode has an Integer Underflow in PE Page Hash Calculation Can Cause Out-of-Bounds Read", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-191", "lang": "en", "description": "CWE-191: Integer Underflow (Wrap or Wraparound)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/mtrojnar/osslsigncode/security/advisories/GHSA-76vv-x5rr-q3mr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mtrojnar/osslsigncode/security/advisories/GHSA-76vv-x5rr-q3mr"}, {"name": "https://github.com/mtrojnar/osslsigncode/commit/2a5409b7c4b6c6fad2b093531e8fea6cf08e1568", "tags": ["x_refsource_MISC"], "url": "https://github.com/mtrojnar/osslsigncode/commit/2a5409b7c4b6c6fad2b093531e8fea6cf08e1568"}, {"name": "https://github.com/mtrojnar/osslsigncode/releases/tag/2.13", "tags": ["x_refsource_MISC"], "url": "https://github.com/mtrojnar/osslsigncode/releases/tag/2.13"}], "affected": [{"vendor": "mtrojnar", "product": "osslsigncode", "versions": [{"version": "< 2.13", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T16:01:51.626Z"}, "descriptions": [{"lang": "en", "value": "osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an integer underflow vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code (pe_page_hash_calc()). When page hash processing is performed on a PE file, the function subtracts hdrsize from pagesize without first validating that pagesize >= hdrsize. If a malicious PE file sets SizeOfHeaders (hdrsize) larger than SectionAlignment (pagesize), the subtraction underflows and produces a very large unsigned length. The code allocates a zero-filled buffer of pagesize bytes and then attempts to hash pagesize - hdrsize bytes from that buffer. After the underflow, this results in an out-of-bounds read from the heap and can crash the process. The vulnerability can be triggered while signing a malicious PE file with page hashing enabled (-ph), or while verifying a malicious signed PE file that already contains page hashes. Verification of an already signed file does not require the verifier to pass -ph. This vulnerability is fixed in 2.13."}], "source": {"advisory": "GHSA-76vv-x5rr-q3mr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-09T19:12:57.585841Z", "id": "CVE-2026-39855", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T19:22:16.659Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39855", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-07T19:13:20.378Z", "datePublished": "2026-04-09T15:58:38.559Z", "dateUpdated": "2026-04-09T19:22:16.659Z"}, "containers": {"cna": {"title": "osslsigncode has an Integer Underflow in PE Page Hash Calculation Can Cause Out-of-Bounds Read", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-191", "lang": "en", "description": "CWE-191: Integer Underflow (Wrap or Wraparound)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/mtrojnar/osslsigncode/security/advisories/GHSA-76vv-x5rr-q3mr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mtrojnar/osslsigncode/security/advisories/GHSA-76vv-x5rr-q3mr"}, {"name": "https://github.com/mtrojnar/osslsigncode/commit/2a5409b7c4b6c6fad2b093531e8fea6cf08e1568", "tags": ["x_refsource_MISC"], "url": "https://github.com/mtrojnar/osslsigncode/commit/2a5409b7c4b6c6fad2b093531e8fea6cf08e1568"}, {"name": "https://github.com/mtrojnar/osslsigncode/releases/tag/2.13", "tags": ["x_refsource_MISC"], "url": "https://github.com/mtrojnar/osslsigncode/releases/tag/2.13"}], "affected": [{"vendor": "mtrojnar", "product": "osslsigncode", "versions": [{"version": "< 2.13", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T16:01:51.626Z"}, "descriptions": [{"lang": "en", "value": "osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an integer underflow vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code (pe_page_hash_calc()). When page hash processing is performed on a PE file, the function subtracts hdrsize from pagesize without first validating that pagesize >= hdrsize. If a malicious PE file sets SizeOfHeaders (hdrsize) larger than SectionAlignment (pagesize), the subtraction underflows and produces a very large unsigned length. The code allocates a zero-filled buffer of pagesize bytes and then attempts to hash pagesize - hdrsize bytes from that buffer. After the underflow, this results in an out-of-bounds read from the heap and can crash the process. The vulnerability can be triggered while signing a malicious PE file with page hashing enabled (-ph), or while verifying a malicious signed PE file that already contains page hashes. Verification of an already signed file does not require the verifier to pass -ph. This vulnerability is fixed in 2.13."}], "source": {"advisory": "GHSA-76vv-x5rr-q3mr", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39855", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-09T19:12:57.585841Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T19:13:05.667Z"}}]}}

{"affected": [{"affectedData": [{"product": "osslsigncode", "vendor": "mtrojnar", "versions": [{"status": "affected", "version": "< 2.13"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:osslsigncode_project:osslsigncode:*:*:*:*:*:*:*:*", "matchCriteriaId": "3F16716F-B2C3-41F9-B32B-CFD011129F12", "versionEndExcluding": "2.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an integer underflow vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code (pe_page_hash_calc()). When page hash processing is performed on a PE file, the function subtracts hdrsize from pagesize without first validating that pagesize >= hdrsize. If a malicious PE file sets SizeOfHeaders (hdrsize) larger than SectionAlignment (pagesize), the subtraction underflows and produces a very large unsigned length. The code allocates a zero-filled buffer of pagesize bytes and then attempts to hash pagesize - hdrsize bytes from that buffer. After the underflow, this results in an out-of-bounds read from the heap and can crash the process. The vulnerability can be triggered while signing a malicious PE file with page hashing enabled (-ph), or while verifying a malicious signed PE file that already contains page hashes. Verification of an already signed file does not require the verifier to pass -ph. This vulnerability is fixed in 2.13."}, {"lang": "es", "value": "osslsigncode es una herramienta que implementa la firma Authenticode y el sellado de tiempo. Antes de la versi\u00f3n 2.13, existe una vulnerabilidad de desbordamiento negativo de enteros en osslsigncode versi\u00f3n 2.12 y anteriores en el c\u00f3digo de c\u00e1lculo de hash de p\u00e1gina PE (pe_page_hash_calc()). Cuando se realiza el procesamiento de hash de p\u00e1gina en un archivo PE, la funci\u00f3n resta hdrsize de pagesize sin validar primero que pagesize >= hdrsize. Si un archivo PE malicioso establece SizeOfHeaders (hdrsize) mayor que SectionAlignment (pagesize), la resta sufre un desbordamiento negativo y produce una longitud sin signo muy grande. El c\u00f3digo asigna un b\u00fafer rellenado con ceros de pagesize bytes y luego intenta aplicar hash a pagesize - hdrsize bytes de ese b\u00fafer. Despu\u00e9s del desbordamiento negativo, esto resulta en una lectura fuera de l\u00edmites de la pila y puede bloquear el proceso. La vulnerabilidad puede ser activada mientras se firma un archivo PE malicioso con el hash de p\u00e1gina habilitado (-ph), o mientras se verifica un archivo PE firmado malicioso que ya contiene hashes de p\u00e1gina. La verificaci\u00f3n de un archivo ya firmado no requiere que el verificador pase -ph. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.13."}], "id": "CVE-2026-39855", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39855", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-09T19:12:57.585841Z", "version": "2.0.3"}}]}, "published": "2026-04-09T17:16:29.140", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/mtrojnar/osslsigncode/commit/2a5409b7c4b6c6fad2b093531e8fea6cf08e1568"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/mtrojnar/osslsigncode/releases/tag/2.13"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/mtrojnar/osslsigncode/security/advisories/GHSA-76vv-x5rr-q3mr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-190"}, {"lang": "en", "value": "CWE-191"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.13)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "osslsigncode", "source": "cna", "vendor": "mtrojnar"}, "product": "osslsigncode", "vendor": "mtrojnar"}], "analysis": {"en": {"generated_at": "2026-04-09T17:23:17.556029+00:00", "value": {"mitigation_remediation": ["Update osslsigncode to version 2.13 or newer as released by the vendor.", "If an upgrade is not immediately possible, avoid running osslsigncode with the \u2013ph option on files that are not verified or coming from trusted sources.", "Monitor for abnormal termination or memory errors in environments that continue to use older releases."], "summary": {"action": "Patch Immediately", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The flaw affects the osslsigncode project produced by the developer mtrojnar, specifically any release version 2.12 or earlier. Version 2.13 and later incorporate a patch that removes the underflow.", "description_and_impact": "osslsigncode, a tool that signs and timestamps PE files, contains an integer underflow in its page-hash calculation code when a PE file\u2019s SizeOfHeaders exceeds its SectionAlignment. The faulty subtraction produces a very large buffer size, causing the program to read beyond the allocated memory and crash. While the outcome is a denial of service for the signing or verifying process, the out-of-bounds read could potentially leak heap data in certain scenarios.", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate severity. No EPSS value is available, and the issue is not listed in the CISA KEV catalog, suggesting it is not a widely exploited vulnerability at present. An attacker can trigger the crash by providing a crafted PE file that uses page hashing (the \u2013ph option) during signing or by feeding a signed file containing page hashes to the verifier. Successful exploitation requires access to the osslsigncode invocation, so the threat is primarily local or arises when the tool is run on untrusted files."}}}}, "created": "2026-04-10T08:53:05.961354+00:00", "updated": "2026-04-10T09:32:18.670947+00:00", "vendors": ["mtrojnar", "mtrojnar$PRODUCT$osslsigncode"]}