CVE-2026-39853

{
  "id": "CVE-2026-39853",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-09T16:16:31.233",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.12, A stack buffer overflow vulnerability exists in osslsigncode in several signature verification paths. During verification of a PKCS#7 signature, the code copies the digest value from a parsed SpcIndirectDataContent structure into a fixed-size stack buffer  (mdbuf[EVP_MAX_MD_SIZE], 64 bytes) without validating that the source length fits within the destination buffer. This pattern is present in the verification handlers for PE, MSI, CAB, and script files. An attacker can craft a malicious signed file with an oversized digest field in SpcIndirectDataContent. When a user verifies such a file with osslsigncode verify, the unbounded memcpy can overflow the stack buffer and corrupt adjacent stack state. This vulnerability is fixed in 2.12."
    },
    {
      "lang": "es",
      "value": "osslsigncode es una herramienta que implementa la firma y el sellado de tiempo Authenticode. Anterior a la 2.12, existe una vulnerabilidad de desbordamiento de búfer de pila en osslsigncode en varias rutas de verificación de firma. Durante la verificación de una firma PKCS#7, el código copia el valor de resumen de una estructura SpcIndirectDataContent analizada en un búfer de pila de tamaño fijo (mdbuf[EVP_MAX_MD_SIZE], 64 bytes) sin validar que la longitud de origen encaje dentro del búfer de destino. Este patrón está presente en los manejadores de verificación para archivos PE, MSI, CAB y de script. Un atacante puede crear un archivo firmado malicioso con un campo de resumen sobredimensionado en SpcIndirectDataContent. Cuando un usuario verifica dicho archivo con osslsigncode verify, el memcpy sin límites puede desbordar el búfer de pila y corromper el estado de pila adyacente. Esta vulnerabilidad está corregida en la 2.12."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "mtrojnar",
          "product": "osslsigncode",
          "versions": [
            {
              "version": "< 2.12",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-09T16:13:50.325421Z",
          "id": "CVE-2026-39853",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:osslsigncode_project:osslsigncode:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.12",
              "matchCriteriaId": "99F63D36-1A36-4A6E-A2A3-02B68D5BA069"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/mtrojnar/osslsigncode/commit/cbee1e723c5a8547302bd841ad9943ed8144db68",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/mtrojnar/osslsigncode/releases/tag/2.12",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/mtrojnar/osslsigncode/security/advisories/GHSA-hx87-8754-xvh4",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}