CVE-2026-39853: osslsigncode Buffer Overflow Vulnerability

CVE-2026-39853 Overview

CVE-2026-39853 is a stack buffer overflow vulnerability in osslsigncode, an open-source tool that implements Authenticode signing and timestamping for executable files. The vulnerability exists in multiple signature verification paths where the code copies a digest value from a parsed SpcIndirectDataContent structure into a fixed-size stack buffer without validating that the source length fits within the destination buffer.

Critical Impact

An attacker can craft a malicious signed file with an oversized digest field that, when verified by osslsigncode, triggers a stack buffer overflow capable of corrupting adjacent stack state and potentially enabling arbitrary code execution.

Affected Products

• osslsigncode versions prior to 2.12
• PE file verification handler
• MSI, CAB, and script file verification handlers

Discovery Timeline

• 2026-04-09 - CVE CVE-2026-39853 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-39853

Vulnerability Analysis

This vulnerability stems from unsafe memory handling during PKCS#7 signature verification. When osslsigncode parses a signed file, it extracts the message digest from the SpcIndirectDataContent ASN.1 structure and copies it into a stack-allocated buffer mdbuf[EVP_MAX_MD_SIZE], which is 64 bytes in size. The vulnerable code path performs a direct memcpy() operation using the digest length from the parsed structure without any bounds validation.

The vulnerability affects multiple file type handlers including PE executables, MSI installers, CAB archives, and script files—all of which share similar verification logic. An attacker who can convince a user to verify a maliciously crafted signed file can trigger the overflow, potentially achieving code execution in the context of the osslsigncode process.

Root Cause

The root cause is classified as CWE-121 (Stack-based Buffer Overflow). The vulnerable code directly copies attacker-controlled data from the parsed idc->messageDigest->digest->data field into a fixed-size stack buffer using the untrusted idc->messageDigest->digest->length value. This allows an attacker to specify a digest length exceeding 64 bytes, causing the memcpy() operation to write beyond the bounds of the destination buffer and corrupt adjacent stack memory.

Attack Vector

The attack requires local access with user interaction—specifically, a user must be tricked into running osslsigncode verify against a maliciously crafted signed file. The attacker crafts a file containing a valid PKCS#7 signature structure but with an oversized digest field in the SpcIndirectDataContent. When the verification routine processes this malformed structure, the unbounded memory copy overwrites stack data, potentially including return addresses or other security-critical values.

The following patches show the vulnerable memcpy() patterns that were replaced with safe extraction functions:

Patch in cab.c:

         const u_char *p = content_val->data;
         SpcIndirectDataContent *idc = d2i_SpcIndirectDataContent(NULL, &p, content_val->length);
         if (idc) {
-            if (idc->messageDigest && idc->messageDigest->digest && idc->messageDigest->digestAlgorithm) {
-                mdtype = OBJ_obj2nid(idc->messageDigest->digestAlgorithm->algorithm);
-                memcpy(mdbuf, idc->messageDigest->digest->data, (size_t)idc->messageDigest->digest->length);
+            if (spc_extract_digest_safe(idc, mdbuf, &mdtype) < 0) {
+                SpcIndirectDataContent_free(idc);
+                return 0; /* FAILED */
             }
             SpcIndirectDataContent_free(idc);
         }

Source: GitHub Commit Update

Patch in cat.c:

     idc = d2i_SpcIndirectDataContent(NULL, &data, ASN1_STRING_length(value));
     if (!idc)
         return 0; /* FAILED */
-    if (idc->messageDigest && idc->messageDigest->digest && idc->messageDigest->digestAlgorithm) {
-        /* get a digest algorithm a message digest of the file from the content */
-        mdtype = OBJ_obj2nid(idc->messageDigest->digestAlgorithm->algorithm);
-        memcpy(mdbuf, idc->messageDigest->digest->data, (size_t)idc->messageDigest->digest->length);
+    if (spc_extract_digest_safe(idc, mdbuf, &mdtype) < 0) {
+        SpcIndirectDataContent_free(idc);
+        return 0; /* FAILED */
     }
     SpcIndirectDataContent_free(idc);
     if (mdtype == -1) {

Source: GitHub Commit Update

Detection Methods for CVE-2026-39853

Indicators of Compromise

• Presence of PE, MSI, CAB, or script files with abnormally large digest fields in their Authenticode signatures
• Crash dumps or core files from osslsigncode processes showing stack corruption
• Unexpected process termination when running osslsigncode verify commands

Detection Strategies

• Monitor for osslsigncode process crashes during signature verification operations
• Implement file integrity monitoring for systems where osslsigncode is used in automated workflows
• Deploy endpoint detection rules that identify exploitation attempts targeting stack buffer overflows in verification tools

Monitoring Recommendations

• Enable logging for all osslsigncode invocations in build pipelines and signing infrastructure
• Monitor for unusual file submissions to signing or verification services that may be probing for vulnerable instances
• Implement process behavior analysis to detect memory corruption exploitation attempts

How to Mitigate CVE-2026-39853

Immediate Actions Required

• Upgrade osslsigncode to version 2.12 or later immediately
• Audit systems for any instances of osslsigncode prior to version 2.12
• Review logs for any suspicious signature verification failures that could indicate exploitation attempts

Patch Information

The vulnerability has been fixed in osslsigncode version 2.12. The patch introduces a new safe extraction function spc_extract_digest_safe() that validates the digest length before copying. The security fix is available at:

• GitHub Release 2.12
• Security Advisory GHSA-hx87-8754-xvh4
• Commit cbee1e7

Workarounds

• Avoid using vulnerable versions of osslsigncode to verify untrusted files until patching is complete
• Isolate osslsigncode verification operations in sandboxed environments with limited privileges
• Implement strict input validation on files before passing them to osslsigncode for verification

# Verify osslsigncode version and upgrade if necessary
osslsigncode --version

# On systems with package managers, upgrade to latest version
# Example for systems building from source:
git clone https://github.com/mtrojnar/osslsigncode.git
cd osslsigncode
git checkout 2.12
cmake -B build && cmake --build build
sudo cmake --install build