CVE-2026-39855 Overview
An integer underflow vulnerability has been discovered in osslsigncode, a widely-used tool for implementing Authenticode signing and timestamping of PE (Portable Executable) files. The vulnerability exists in versions prior to 2.13 within the PE page-hash computation code, specifically in the pe_page_hash_calc() function. When processing PE files with page hashing enabled, the function fails to validate that pagesize is greater than or equal to hdrsize before performing subtraction, leading to an integer underflow condition that can result in out-of-bounds heap reads and process crashes.
Critical Impact
Attackers can craft malicious PE files that, when signed or verified, trigger an integer underflow leading to out-of-bounds heap reads and denial of service. This affects both signing operations with -ph flag and verification of already-signed malicious files.
Affected Products
- osslsigncode versions prior to 2.13
- osslsigncode version 2.12 and earlier
Discovery Timeline
- 2026-04-09 - CVE CVE-2026-39855 published to NVD
- 2026-04-09 - Last updated in NVD database
Technical Details for CVE-2026-39855
Vulnerability Analysis
This vulnerability stems from an integer underflow condition in the pe_page_hash_calc() function responsible for computing page hashes on PE files. The vulnerable code path subtracts hdrsize (derived from the PE file's SizeOfHeaders field) from pagesize (derived from SectionAlignment) without proper bounds validation. When a malicious PE file is crafted with SizeOfHeaders larger than SectionAlignment, this arithmetic operation underflows, producing an extremely large unsigned integer value.
The consequence is severe: the code allocates a zero-filled buffer of pagesize bytes but then attempts to hash pagesize - hdrsize bytes from that buffer. After the underflow, this value becomes very large, causing an out-of-bounds read from the heap. This memory corruption can crash the osslsigncode process, resulting in denial of service.
The vulnerability is classified as CWE-125 (Out-of-Bounds Read), which accurately describes the memory safety violation that occurs after the integer underflow.
Root Cause
The root cause is insufficient input validation in the pe_page_hash_calc() function. The code trusts that the PE file's SizeOfHeaders value is within acceptable bounds relative to SectionAlignment without performing proper validation. This violates the principle of defense in depth, as PE files are untrusted input that may have been maliciously crafted. The fix adds an additional boundary check to ensure hdrsize does not exceed filebound, preventing the underflow condition.
Attack Vector
The attack can be executed through two vectors:
Signing Vector: An attacker convinces a victim to sign a malicious PE file with page hashing enabled using the -ph flag. This could occur in CI/CD pipelines or build systems that process untrusted executables.
Verification Vector: An attacker provides a pre-signed malicious PE file containing page hashes for verification. Importantly, the victim does not need to pass the -ph flag during verification—simply verifying a malicious signed file triggers the vulnerability.
The following patch demonstrates the security fix implemented in version 2.13:
return NULL; /* FAILED */
}
off = ctx->pe_ctx->header_size + 160 + (size_t)ctx->pe_ctx->pe32plus * 16;
- if (hdrsize < off) {
+ if (hdrsize < off || hdrsize > filebound) {
BIO_free_all(bhash);
return NULL; /* FAILED: header too small */
}
Source: GitHub Commit Update
The fix adds a check ensuring hdrsize does not exceed filebound, preventing the integer underflow by rejecting PE files with invalid header sizes early in the processing pipeline.
Detection Methods for CVE-2026-39855
Indicators of Compromise
- Unexpected crashes of osslsigncode processes during signing or verification operations
- Core dumps or crash reports showing heap memory access violations in pe_page_hash_calc() or related functions
- PE files with abnormally large SizeOfHeaders values relative to SectionAlignment
Detection Strategies
- Monitor for osslsigncode process crashes with SIGSEGV or similar memory access violation signals
- Implement file integrity monitoring on PE files being processed through signing pipelines
- Deploy static analysis tools to flag PE files where SizeOfHeaders exceeds SectionAlignment
- Review build and signing pipeline logs for unexpected osslsigncode failures
Monitoring Recommendations
- Enable crash reporting and analysis for systems running osslsigncode
- Implement logging for all PE file signing and verification operations
- Set up alerts for repeated osslsigncode process failures that may indicate exploitation attempts
- Monitor system memory usage patterns during signing operations for anomalous behavior
How to Mitigate CVE-2026-39855
Immediate Actions Required
- Upgrade osslsigncode to version 2.13 or later immediately
- Audit signing pipelines to identify all instances of osslsigncode that require updates
- Implement input validation for PE files before processing with osslsigncode
- Review recently signed or verified PE files for potential exploitation attempts
Patch Information
The vulnerability has been fixed in osslsigncode version 2.13. The patch adds additional bounds checking to ensure the hdrsize value does not exceed filebound, preventing the integer underflow condition. Organizations should update to version 2.13 or later as soon as possible.
Relevant patch resources:
Workarounds
- Avoid processing untrusted PE files with osslsigncode until the patch is applied
- Implement pre-validation of PE file headers before passing to osslsigncode
- Run osslsigncode in sandboxed environments to limit the impact of crashes
- Disable page hashing (-ph) if not strictly required for your signing workflow
# Upgrade osslsigncode to patched version
# From source:
git clone https://github.com/mtrojnar/osslsigncode.git
cd osslsigncode
git checkout 2.13
mkdir build && cd build
cmake ..
make && sudo make install
# Verify installed version
osslsigncode --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
