CVE-2026-39855: 
NixOS vulnerability analysis and mitigation

CVE-2026-39855 is an integer underflow vulnerability in osslsigncode's PE page-hash computation code (pe_page_hash_calc()) that can cause an out-of-bounds heap read and process crash. It affects osslsigncode versions 2.12 and earlier, and was disclosed on April 9, 2026, with a fix released in version 2.13 (published February 10, 2026). The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an integer underflow (CWE-191) combined with an out-of-bounds read (CWE-125) in pe_page_hash_calc(). The function subtracts hdrsize (derived from SizeOfHeaders) from pagesize (derived from SectionAlignment) without first validating that pagesize >= hdrsize. When a malicious PE file sets SizeOfHeaders larger than SectionAlignment, the unsigned subtraction wraps around to a very large value, causing the subsequent heap read to access memory far beyond the allocated buffer. The fix in commit 2a5409b adds a bounds check (hdrsize > filebound) to prevent the underflow condition (GitHub Commit, GitHub Advisory). The vulnerability can be triggered in two scenarios: signing a malicious PE file with the -ph (page hashing) flag enabled, or verifying an already-signed PE file containing page hashes — the latter requiring no special flags from the verifier (GitHub Advisory).

Successful exploitation results in a denial of service through an application crash (availability impact: High). There is no confirmed confidentiality or integrity impact — the out-of-bounds read terminates the process but does not expose sensitive data or allow code execution based on current evidence. The scope is limited to the osslsigncode process itself, with no lateral movement potential identified (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been released, though the GitHub advisory notes that a PoC trigger is reported to exist. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term (GitHub Advisory, Feedly).

1. Craft a malicious PE file: Create or modify a PE (Portable Executable) file such that the SizeOfHeaders field in the PE optional header is set to a value larger than the SectionAlignment field, violating the expected relationship between these two values.
2. Trigger via signing: Supply the crafted PE file to a vulnerable osslsigncode instance with page hashing enabled: osslsigncode sign -ph -in malicious.exe -out signed.exe [signing options]. The pe_page_hash_calc() function will perform the underflowing subtraction during processing.
3. Trigger via verification (no -ph required): Alternatively, embed the malicious page-hash structure into an already-signed PE file and submit it for verification: osslsigncode verify -in malicious_signed.exe. The verifier will process the embedded page hashes and trigger the same vulnerable code path without requiring the -ph flag.
4. Observe crash: The integer underflow produces a very large unsigned length, causing an out-of-bounds heap read that crashes the osslsigncode process, achieving denial of service (GitHub Advisory, GitHub Commit).

• Process: Unexpected crashes or abnormal termination of the osslsigncode process, particularly during signing or verification operations involving PE files.
• Logs: Operating system crash logs (e.g., core dumps, Windows Error Reporting entries) referencing the osslsigncode binary; segmentation fault or heap corruption error messages in application logs.
• File System: Presence of unexpected or externally supplied PE files submitted for signing or verification, especially files with anomalous header values (SizeOfHeaders > SectionAlignment); core dump files in the working directory of osslsigncode.
• Network: If osslsigncode is exposed as part of a build pipeline or signing service, repeated submission of PE files from unusual sources or automated scripts targeting the signing endpoint (GitHub Advisory).

The primary remediation is to upgrade osslsigncode to version 2.13 or later, which includes the bounds check fix in pe_page_hash_calc() (GitHub Release). For systems unable to patch immediately, restrict osslsigncode to processing only trusted PE files from known-good sources, and avoid enabling the -ph (page hashing) flag unless strictly necessary — this eliminates the signing-path trigger, though the verification-path trigger remains if processing externally supplied signed files. Additionally, limit access to systems running osslsigncode and monitor for unexpected process crashes as a potential indicator of exploitation attempts (Feedly).

The vulnerability was credited to researcher Antoni Klajn (Opera) as the finder, and the fix was contributed by Małgorzata Olszówka, as noted in the osslsigncode 2.13 release notes. Red Hat tracked the issue via Bugzilla and the advisory was published on April 9, 2026. The release was described by the maintainer as addressing "multiple security vulnerabilities" with users "strongly encouraged to upgrade" (GitHub Release, Red Hat Bugzilla).