Integer Underflow Vulnerability in osslsigncode Tool by mTrojnar

CVE-2026-39855

What is CVE-2026-39855?

An integer underflow vulnerability was identified in osslsigncode prior to version 2.13. This issue arises during the PE page-hash computation within the pe_page_hash_calc() function, where a maliciously crafted PE file could exploit improper validation of header and section sizes. The vulnerability allows attackers to cause out-of-bounds reads from memory, potentially leading to application crashes during the signing or verification of PE files with page hashing enabled. It is crucial to update to version 2.13 or later to mitigate this risk.

References