CVE-2026-39856: 
NixOS vulnerability analysis and mitigation

CVE-2026-39856 is an out-of-bounds read vulnerability in osslsigncode, a tool implementing Authenticode signing and timestamping for PE (Portable Executable) files. The flaw exists in the pe_page_hash_calc() function in versions 2.12 and earlier, where section header values are used without validating that the referenced memory region lies within the mapped file. It was disclosed on April 9, 2026, and fixed in version 2.13. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper input validation (CWE-20) and out-of-bounds read (CWE-125) in the pe_page_hash_calc() function within pe.c. When processing PE sections for page hashing, the function reads PointerToRawData and SizeOfRawData values directly from section headers without verifying that the referenced data region falls within the bounds of the mapped file. An attacker can craft a PE file with section headers whose offsets point beyond the end of the file, causing osslsigncode to attempt hashing data from an invalid memory region. The vulnerability can be triggered in two scenarios: (1) when signing a malicious PE file with the -ph (page hashing) flag enabled, or (2) when verifying an already-signed malicious PE file containing page hashes — the latter requiring no special flags from the verifier. The fix in commit 92f8761 adds explicit bounds checks for the section table and per-section data regions before any memory access (GitHub Advisory, GitHub Commit).

Successful exploitation results in a denial-of-service condition via application crash due to the out-of-bounds read during PE page-hash processing. There is no confirmed confidentiality or integrity impact — the advisory explicitly notes that while a crash scenario is supported, no reliable memory disclosure channel has been demonstrated. The impact is limited to the availability of the osslsigncode process, affecting build pipelines, code-signing workflows, or verification systems that process untrusted PE files (GitHub Advisory).

A proof-of-concept trigger is reported to exist according to the GitHub Security Advisory, though no public PoC exploit code has been released. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The vulnerability requires local access and user interaction (e.g., a user must process a malicious PE file), limiting its attack surface. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Craft a malicious PE file: Create a PE file with section headers where PointerToRawData or SizeOfRawData values reference memory regions beyond the actual end of the file.
2. Trigger via signing: Provide the crafted PE file to a user or automated system running osslsigncode 2.12 or earlier with page hashing enabled: osslsigncode sign -ph -in malicious.exe -out signed.exe [signing options]. The pe_page_hash_calc() function will attempt to read from the out-of-bounds region.
3. Trigger via verification (no -ph required): Alternatively, pre-sign the malicious PE file so it already contains page hashes, then submit it for verification: osslsigncode verify -in malicious_signed.exe. The verifier will process the embedded page hashes and trigger the same vulnerable code path without requiring the -ph flag.
4. Achieve denial of service: The out-of-bounds read causes the osslsigncode process to crash, disrupting any signing or verification pipeline that depends on it (GitHub Advisory, GitHub Commit).

• Process: Unexpected crash or abnormal termination of the osslsigncode process, particularly during signing with -ph or during verification of PE files.
• Logs: Segmentation fault or memory access error messages in system logs (e.g., dmesg, syslog) associated with the osslsigncode process; stderr output containing messages such as Section table out of bounds or Page hash buffer overflow prevented (added in the patched version 2.13).
• File System: Presence of PE files with anomalous section headers where PointerToRawData or SizeOfRawData values exceed the actual file size — detectable via PE analysis tools such as pefile (Python) or pedump.
• Network: Unexpected delivery of PE files from untrusted or external sources to systems running osslsigncode in automated signing pipelines.

The vulnerability is fixed in osslsigncode version 2.13, released February 10, 2026, which includes bounds validation for section table and per-section data regions in pe_page_hash_calc(). Organizations running version 2.12 or earlier should upgrade to 2.13 immediately. If immediate patching is not possible, restrict osslsigncode usage to PE files from trusted, known-good sources, and avoid processing untrusted or externally supplied PE files. Additionally, consider wrapping osslsigncode invocations in sandboxed environments to limit the impact of a crash (GitHub Release, GitHub Advisory).

Red Hat tracked the vulnerability via Bugzilla (Bug 2456945) and assigned it medium severity, reflecting the limited exploitability and availability-only impact. The osslsigncode maintainer grouped this fix with several other security fixes in the 2.13 release, noting that users are "strongly encouraged to upgrade" as issues may be exploitable when processing untrusted files. Community reaction has been minimal, consistent with the moderate severity and limited attack surface of the vulnerability (Red Hat Bugzilla, GitHub Release).