CVE-2026-39853: osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.12, A stack buffer overflow…
CVE-2026-39853 · Severity: high · CVSS 7.8 · Published 2026-04-09
osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.12, A stack buffer overflow vulnerability exists in osslsigncode in several signature verification paths. During verification of a PKCS#7 signature, the code copies the digest value from a parsed SpcIndirectDataContent structure into a fixed-size stack buffer (mdbuf[EVP_MAX_MD_SIZE], 64 bytes) without validating that the source length fits within the destination buffer. This pattern is present in the verification handlers for PE, MSI, CAB, and script files. An attacker can craft a malicious signed file with an oversized digest field in SpcIndirectDataContent. When a user verifies such a file with osslsigncode verify, the unbounded memcpy can overflow the stack buffer and corrupt adjacent stack state. This vulnerability is fixed in 2.12.
No. Junglewise Threat Intelligence has no report of CVE-2026-39853 being exploited in the wild.
How severe is CVE-2026-39853?
High severity, with a CVSS score of 7.8, published 9 April 2026.
Which products and versions are affected?
Osslsigncode Project Osslsigncode. The advisory does not name versions.
Is there a fix for CVE-2026-39853?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2026-39853?
Check whether you run Osslsigncode Project Osslsigncode. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.