Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.12, A stack buffer overflow vulnerability exists in osslsigncode in several signature verification paths. During verification of a PKCS#7 signature, the code copies the digest value from a parsed SpcIndirectDataContent structure into a fixed-size stack buffer (mdbuf[EVP_MAX_MD_SIZE], 64 bytes) without validating that the source length fits within the destination buffer. This pattern is present in the verification handlers for PE, MSI, CAB, and script files. An attacker can craft a malicious signed file with an oversized digest field in SpcIndirectDataContent. When a user verifies such a file with osslsigncode verify, the unbounded memcpy can overflow the stack buffer and corrupt adjacent stack state. This vulnerability is fixed in 2.12.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-39853 osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.12, A stack buffer overflow vulnerability exists in osslsigncode in several s… https://www.cve.org/CVERecord?id=CVE-2026-39853
Post summary
The message reports a stack buffer overflow vulnerability in osslsigncode (before v2.12) and links to the CVE record, providing basic technical details without any PoC, exploit, or patch information.
CVE-2026-39853 Stack Buffer Overflow in osslsigncode Signature Verification Prior to 2.12 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-39853
Post summary
The post identifies a stack buffer overflow CVE (CVE‑2026‑39853) affecting osslsigncode versions prior to 2.12 and links to a vulnerability detail page, but provides no exploitation or mitigation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | osslsigncode_project | osslsigncode | - | - | - |