CVE-2026-39853: 
NixOS vulnerability analysis and mitigation

CVE-2026-39853 is a stack-based buffer overflow vulnerability in osslsigncode, a tool implementing Authenticode signing and timestamping. During PKCS#7 signature verification, the code performs an unbounded memcpy of a digest value from a parsed SpcIndirectDataContent structure into a fixed-size 64-byte stack buffer (mdbuf[EVP_MAX_MD_SIZE]) without validating the source length. All versions prior to 2.12 are affected, with the flaw present in verification handlers for PE, MSI, CAB, and script files. It was disclosed on April 9, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write), stemming from improper input validation (CWE-20) when processing the messageDigest field of a SpcIndirectDataContent ASN.1 structure. The vulnerable code pattern — memcpy(mdbuf, idc->messageDigest->digest->data, (size_t)idc->messageDigest->digest->length) — copies attacker-controlled data without first checking that digest->length does not exceed EVP_MAX_MD_SIZE (64 bytes). This pattern existed identically across pe.c, msi.c, cab.c, script.c, and osslsigncode.c. The fix in version 2.12 introduces a new helper function spc_extract_digest_safe() that validates the digest length before copying (GitHub Advisory, Patch Commit).

Successful exploitation can result in arbitrary code execution in the context of the user running osslsigncode, as well as denial of service via application crash due to stack corruption. The attack vector is local and requires user interaction — specifically, a user must run osslsigncode verify against a maliciously crafted signed file — but no elevated privileges are required. The upstream 2.12 release notes describe this as a critical memory corruption vulnerability that can lead to arbitrary code execution during verification of untrusted signed files (GitHub Release, GitHub Advisory).

A proof-of-concept trigger is reported to exist according to the GitHub Security Advisory, though no public exploit code has been confirmed as of the time of reporting (GitHub Advisory). There is no evidence of active in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014% (0.000140), indicating a low probability of exploitation in the near term (Feedly).

1. Craft a malicious signed file: Create a PE, MSI, CAB, or script file with a crafted PKCS#7 signature where the SpcIndirectDataContent.messageDigest.digest field contains a payload exceeding 64 bytes (the EVP_MAX_MD_SIZE limit), embedding shellcode or a ROP chain in the oversized digest data.
2. Deliver the file to the target: Social-engineer or otherwise deliver the malicious signed file to a system where osslsigncode (version < 2.12) is installed and used for signature verification of untrusted files.
3. Trigger verification: Induce the user or an automated pipeline to run osslsigncode verify <malicious_file>, which initiates PKCS#7 signature parsing and triggers the vulnerable memcpy in the relevant format handler (e.g., pe_verify_digests()).
4. Overflow the stack buffer: The unbounded memcpy writes beyond the 64-byte mdbuf stack buffer, corrupting adjacent stack state including the saved return address or other control-flow data.
5. Achieve code execution or crash: Depending on stack layout and platform mitigations (e.g., stack canaries, ASLR), the overflow may crash the application (DoS) or redirect execution to attacker-controlled code running as the invoking user (GitHub Advisory, Patch Commit).

• Process: Unexpected crash or segmentation fault of the osslsigncode process during a verify operation; core dump files generated in the working directory.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing osslsigncode terminating with signal 11 (SIGSEGV) or signal 6 (SIGABRT) when processing a specific file.
• File System: Presence of unusual or externally sourced PE/MSI/CAB/script files submitted for verification; core dump files (e.g., core, core.<pid>) in directories where osslsigncode was executed.
• Network: If exploitation leads to code execution, outbound connections from the host to unexpected external IPs initiated by processes spawned from osslsigncode or its parent process (e.g., build pipelines, CI/CD agents).

The vulnerability is fixed in osslsigncode version 2.12, released February 2, 2026. Users should upgrade immediately, particularly if osslsigncode is used to verify untrusted or externally sourced signed files (GitHub Release). As interim mitigations: restrict osslsigncode verify operations to files from trusted, controlled sources only; implement application whitelisting to limit which users or pipelines can invoke the tool; and monitor for unexpected crashes of the osslsigncode process. No configuration-based workaround exists that fully mitigates the vulnerability without upgrading.

The vulnerability was reported and fixed by Antoni Klajn of Opera, as credited in the patch commit and release notes (Patch Commit, GitHub Release). Red Hat tracked the issue via Bugzilla and assigned it high severity (Red Hat Bugzilla). Debian's security tracker and Microsoft's MSRC update guide also indexed the CVE, indicating broad ecosystem awareness. Social media activity was limited, with mentions observed on Mastodon and Bluesky shortly after disclosure.