CVE-2026-39853

osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.12, A stack buffer overflow vulnerability exists in osslsigncode in several signature verification paths. During verification of a PKCS#7 signature, the code copies the digest value from a parsed SpcIndirectDataContent structure into a fixed-size stack buffer (mdbuf[EVP_MAX_MD_SIZE], 64 bytes) without validating that the source length fits within the destination buffer. This pattern is present in the verification handlers for PE, MSI, CAB, and script files. An attacker can craft a malicious signed file with an oversized digest field in SpcIndirectDataContent. When a user verifies such a file with osslsigncode verify, the unbounded memcpy can overflow the stack buffer and corrupt adjacent stack state. This vulnerability is fixed in 2.12.

• CWE-121
• CWE-787

• https://github.com/mtrojnar/osslsigncode/commit/cbee1e723c5a8547302bd841ad9943ed8144db68Patch
• https://github.com/mtrojnar/osslsigncode/releases/tag/2.12Product, Release Notes
• https://github.com/mtrojnar/osslsigncode/security/advisories/GHSA-hx87-8754-xvh4Vendor Advisory

Published

Apr 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39848Dockyard is a Docker container management app. Prior to 1.1.…5.4
• CVE-2026-39849Pi-hole FTL is the core engine of the Pi-hole network-level …8.8
• CVE-2026-3985The Creative Mail – Easier WordPress & WooCommerce Email Mar…7.5
• CVE-2026-39850Yii 2 is a PHP application framework. Versions 2.0.54 and pr…7.4
• CVE-2026-39851Saleor is an e-commerce platform. From 2.10.0 to before 3.23…4.3
• CVE-2026-39852Quarkus is a Java framework for building cloud-native applic…8.2
• CVE-2026-39855osslsigncode is a tool that implements Authenticode signing …5.5
• CVE-2026-39856osslsigncode is a tool that implements Authenticode signing …5.5
• CVE-2026-39857ApostropheCMS is an open-source Node.js content management s…5.3
• CVE-2026-39858Traefik is an HTTP reverse proxy and load balancer. Prior to…10
• CVE-2026-39859LiquidJS is a Shopify / GitHub Pages compatible template eng…7.5
• CVE-2026-3986The Calculated Fields Form plugin for WordPress is vulnerabl…6.4