CVE-2026-39856

{
  "id": "CVE-2026-39856",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-09T17:16:29.310",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an out-of-bounds read vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code (pe_page_hash_calc()). When processing PE sections for page hashing, the function uses PointerToRawData and SizeOfRawData values from section headers without validating that the referenced region lies within the mapped file. An attacker can craft a PE file with section headers that point beyond the end of the file. When osslsigncode computes page hashes for such a file, it may attempt to hash data from an invalid memory region, causing an out-of-bounds read and potentially crashing the process. The vulnerability can be triggered while signing a malicious PE file with page hashing enabled (-ph), or while verifying a malicious signed PE file that already contains page hashes. Verification of an already signed file does not require the verifier to pass -ph. This vulnerability is fixed in 2.13."
    },
    {
      "lang": "es",
      "value": "osslsigncode es una herramienta que implementa la firma y el sellado de tiempo Authenticode. Antes de la versión 2.13, existe una vulnerabilidad de lectura fuera de límites en osslsigncode versión 2.12 y anteriores en el código de cálculo de hash de página PE (pe_page_hash_calc()). Al procesar secciones PE para el hashing de páginas, la función utiliza los valores PointerToRawData y SizeOfRawData de los encabezados de sección sin validar que la región referenciada se encuentre dentro del archivo mapeado. Un atacante puede crear un archivo PE con encabezados de sección que apuntan más allá del final del archivo. Cuando osslsigncode calcula los hashes de página para dicho archivo, puede intentar hacer hash de datos de una región de memoria no válida, causando una lectura fuera de límites y potencialmente bloqueando el proceso. La vulnerabilidad puede activarse al firmar un archivo PE malicioso con el hashing de páginas habilitado (-ph), o al verificar un archivo PE firmado malicioso que ya contiene hashes de página. La verificación de un archivo ya firmado no requiere que el verificador pase -ph. Esta vulnerabilidad está corregida en la versión 2.13."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "mtrojnar",
          "product": "osslsigncode",
          "versions": [
            {
              "version": "< 2.13",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-13T20:06:24.980414Z",
          "id": "CVE-2026-39856",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:osslsigncode_project:osslsigncode:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.13",
              "matchCriteriaId": "3F16716F-B2C3-41F9-B32B-CFD011129F12"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/mtrojnar/osslsigncode/commit/92f8761b4770f76a36731969b5040ce3b9a09570",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/mtrojnar/osslsigncode/releases/tag/2.13",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/mtrojnar/osslsigncode/security/advisories/GHSA-rjrx-chvw-8jw8",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}