CVE-2026-39855: osslsigncode Buffer Overflow Vulnerability

CVE-2026-39855 Overview

An integer underflow vulnerability has been discovered in osslsigncode, a widely-used tool for implementing Authenticode signing and timestamping of PE (Portable Executable) files. The vulnerability exists in versions prior to 2.13 within the PE page-hash computation code, specifically in the pe_page_hash_calc() function. When processing PE files with page hashing enabled, the function fails to validate that pagesize is greater than or equal to hdrsize before performing subtraction, leading to an integer underflow condition that can result in out-of-bounds heap reads and process crashes.

Critical Impact
Attackers can craft malicious PE files that, when signed or verified, trigger an integer underflow leading to out-of-bounds heap reads and denial of service. This affects both signing operations with -ph flag and verification of already-signed malicious files.

Affected Products

osslsigncode versions prior to 2.13
osslsigncode version 2.12 and earlier

Discovery Timeline

2026-04-09 - CVE CVE-2026-39855 published to NVD
2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-39855

Vulnerability Analysis

This vulnerability stems from an integer underflow condition in the pe_page_hash_calc() function responsible for computing page hashes on PE files. The vulnerable code path subtracts hdrsize (derived from the PE file's SizeOfHeaders field) from pagesize (derived from SectionAlignment) without proper bounds validation. When a malicious PE file is crafted with SizeOfHeaders larger than SectionAlignment, this arithmetic operation underflows, producing an extremely large unsigned integer value.

The consequence is severe: the code allocates a zero-filled buffer of pagesize bytes but then attempts to hash pagesize - hdrsize bytes from that buffer. After the underflow, this value becomes very large, causing an out-of-bounds read from the heap. This memory corruption can crash the osslsigncode process, resulting in denial of service.

The vulnerability is classified as CWE-125 (Out-of-Bounds Read), which accurately describes the memory safety violation that occurs after the integer underflow.

Root Cause

The root cause is insufficient input validation in the pe_page_hash_calc() function. The code trusts that the PE file's SizeOfHeaders value is within acceptable bounds relative to SectionAlignment without performing proper validation. This violates the principle of defense in depth, as PE files are untrusted input that may have been maliciously crafted. The fix adds an additional boundary check to ensure hdrsize does not exceed filebound, preventing the underflow condition.

Attack Vector

The attack can be executed through two vectors:

Signing Vector: An attacker convinces a victim to sign a malicious PE file with page hashing enabled using the -ph flag. This could occur in CI/CD pipelines or build systems that process untrusted executables.
Verification Vector: An attacker provides a pre-signed malicious PE file containing page hashes for verification. Importantly, the victim does not need to pass the -ph flag during verification—simply verifying a malicious signed file triggers the vulnerability.

The following patch demonstrates the security fix implemented in version 2.13:

         return NULL;  /* FAILED */
     }
     off = ctx->pe_ctx->header_size + 160 + (size_t)ctx->pe_ctx->pe32plus * 16;
-    if (hdrsize < off) {
+    if (hdrsize < off || hdrsize > filebound) {
         BIO_free_all(bhash);
         return NULL;  /* FAILED: header too small */
     }

Source: GitHub Commit Update

The fix adds a check ensuring hdrsize does not exceed filebound, preventing the integer underflow by rejecting PE files with invalid header sizes early in the processing pipeline.

Detection Methods for CVE-2026-39855

Indicators of Compromise

Unexpected crashes of osslsigncode processes during signing or verification operations
Core dumps or crash reports showing heap memory access violations in pe_page_hash_calc() or related functions
PE files with abnormally large SizeOfHeaders values relative to SectionAlignment

Detection Strategies

Monitor for osslsigncode process crashes with SIGSEGV or similar memory access violation signals
Implement file integrity monitoring on PE files being processed through signing pipelines
Deploy static analysis tools to flag PE files where SizeOfHeaders exceeds SectionAlignment
Review build and signing pipeline logs for unexpected osslsigncode failures

Monitoring Recommendations

Enable crash reporting and analysis for systems running osslsigncode
Implement logging for all PE file signing and verification operations
Set up alerts for repeated osslsigncode process failures that may indicate exploitation attempts
Monitor system memory usage patterns during signing operations for anomalous behavior

How to Mitigate CVE-2026-39855

Immediate Actions Required

Upgrade osslsigncode to version 2.13 or later immediately
Audit signing pipelines to identify all instances of osslsigncode that require updates
Implement input validation for PE files before processing with osslsigncode
Review recently signed or verified PE files for potential exploitation attempts

Patch Information

The vulnerability has been fixed in osslsigncode version 2.13. The patch adds additional bounds checking to ensure the hdrsize value does not exceed filebound, preventing the integer underflow condition. Organizations should update to version 2.13 or later as soon as possible.

Relevant patch resources:

Workarounds

Avoid processing untrusted PE files with osslsigncode until the patch is applied
Implement pre-validation of PE file headers before passing to osslsigncode
Run osslsigncode in sandboxed environments to limit the impact of crashes
Disable page hashing (-ph) if not strictly required for your signing workflow

bash

# Upgrade osslsigncode to patched version
# From source:
git clone https://github.com/mtrojnar/osslsigncode.git
cd osslsigncode
git checkout 2.13
mkdir build && cd build
cmake ..
make && sudo make install

# Verify installed version
osslsigncode --version