This issue occurs in the osslsigncode utility when it calculates page hashes for PE files. The routine reads from a memory region whose bounds are derived directly from the section header values, without checking that the referenced data lies within the mapped file. If an attacker provides a PE file whose section headers point past the actual end of the file, the hash computation can read beyond the file’s bounds, resulting in an out‑of‑bounds read that may crash the process. The vulnerability is a classic memory read flaw (CWE‑125) and manifests as a denial of service rather than arbitrary code execution.

Products affected are the osslsigncode tool published by the mtrojnar project, specifically all releases earlier than 2.13, including version 2.12 and earlier. Version 2.13, released in the 2.13 tag, contains the fix and removes the vulnerability.

The CVSS score of 5.5 places the flaw in the medium range; no EPSS value is available and it is not listed in the CISA KEV catalog. The attack requires an attacker to supply a specially crafted PE file to osslsigncode, which is typically a local or privileged action. The defect is triggered when the signer enables page hashing via the -ph flag or when a verifier processes a malformed signed file that already contains page hashes. Because the flaw leads only to a crash, the vulnerability is classified as a denial‑of‑service risk with limited impact scope to the process running osslsigncode.