Description
osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an integer underflow vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code (pe_page_hash_calc()). When page hash processing is performed on a PE file, the function subtracts hdrsize from pagesize without first validating that pagesize >= hdrsize. If a malicious PE file sets SizeOfHeaders (hdrsize) larger than SectionAlignment (pagesize), the subtraction underflows and produces a very large unsigned length. The code allocates a zero-filled buffer of pagesize bytes and then attempts to hash pagesize - hdrsize bytes from that buffer. After the underflow, this results in an out-of-bounds read from the heap and can crash the process. The vulnerability can be triggered while signing a malicious PE file with page hashing enabled (-ph), or while verifying a malicious signed PE file that already contains page hashes. Verification of an already signed file does not require the verifier to pass -ph. This vulnerability is fixed in 2.13.
Published: 2026-04-09
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Immediately
AI Analysis

Impact

osslsigncode, a tool that signs and timestamps PE files, contains an integer underflow in its page-hash calculation code when a PE file’s SizeOfHeaders exceeds its SectionAlignment. The faulty subtraction produces a very large buffer size, causing the program to read beyond the allocated memory and crash. While the outcome is a denial of service for the signing or verifying process, the out-of-bounds read could potentially leak heap data in certain scenarios.

Affected Systems

The flaw affects the osslsigncode project produced by the developer mtrojnar, specifically any release version 2.12 or earlier. Version 2.13 and later incorporate a patch that removes the underflow.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. No EPSS value is available, and the issue is not listed in the CISA KEV catalog, suggesting it is not a widely exploited vulnerability at present. An attacker can trigger the crash by providing a crafted PE file that uses page hashing (the –ph option) during signing or by feeding a signed file containing page hashes to the verifier. Successful exploitation requires access to the osslsigncode invocation, so the threat is primarily local or arises when the tool is run on untrusted files.

Generated by OpenCVE AI on April 9, 2026 at 17:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update osslsigncode to version 2.13 or newer as released by the vendor.
  • If an upgrade is not immediately possible, avoid running osslsigncode with the –ph option on files that are not verified or coming from trusted sources.
  • Monitor for abnormal termination or memory errors in environments that continue to use older releases.

Generated by OpenCVE AI on April 9, 2026 at 17:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 10 Apr 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Mtrojnar
Mtrojnar osslsigncode
Vendors & Products Mtrojnar
Mtrojnar osslsigncode

Fri, 10 Apr 2026 04:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 09 Apr 2026 16:30:00 +0000

Type Values Removed Values Added
Description osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an integer underflow vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code (pe_page_hash_calc()). When page hash processing is performed on a PE file, the function subtracts hdrsize from pagesize without first validating that pagesize >= hdrsize. If a malicious PE file sets SizeOfHeaders (hdrsize) larger than SectionAlignment (pagesize), the subtraction underflows and produces a very large unsigned length. The code allocates a zero-filled buffer of pagesize bytes and then attempts to hash pagesize - hdrsize bytes from that buffer. After the underflow, this results in an out-of-bounds read from the heap and can crash the process. The vulnerability can be triggered while signing a malicious PE file with page hashing enabled (-ph), or while verifying a malicious signed PE file that already contains page hashes. Verification of an already signed file does not require the verifier to pass -ph. This vulnerability is fixed in 2.13.
Title osslsigncode has an Integer Underflow in PE Page Hash Calculation Can Cause Out-of-Bounds Read
Weaknesses CWE-125
CWE-190
CWE-191
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Mtrojnar Osslsigncode
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-04-09T19:22:16.659Z

Reserved: 2026-04-07T19:13:20.378Z

Link: CVE-2026-39855

cve-icon Vulnrichment

Updated: 2026-04-09T19:13:05.667Z

cve-icon NVD

Status : Received

Published: 2026-04-09T17:16:29.140

Modified: 2026-04-09T17:16:29.140

Link: CVE-2026-39855

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-10T09:32:18Z

Weaknesses