{
  "cveId": "CVE-2026-39855",
  "url": "https://patchblox.com/security/cve/CVE-2026-39855",
  "summary": "CVE-2026-39855 is fixed in osslsigncode on 1 platform by DEBIAN-CVE-2026-39855 (version 2.13-1), released April 9, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "osslsigncode has an Integer Underflow in PE Page Hash Calculation Can Cause Out-of-Bounds Read",
  "description": "osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an integer underflow vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code (pe_page_hash_calc()). When page hash processing is performed on a PE file, the function subtracts hdrsize from pagesize without first validating that pagesize \u003E= hdrsize. If a malicious PE file sets SizeOfHeaders (hdrsize) larger than SectionAlignment (pagesize), the subtraction underflows and produces a very large unsigned length. The code allocates a zero-filled buffer of pagesize bytes and then attempts to hash pagesize - hdrsize bytes from that buffer. After the underflow, this results in an out-of-bounds read from the heap and can crash the process. The vulnerability can be triggered while signing a malicious PE file with page hashing enabled (-ph), or while verifying a malicious signed PE file that already contains page hashes. Verification of an already signed file does not require the verifier to pass -ph. This vulnerability is fixed in 2.13.",
  "published": "2026-04-09T17:16:29Z",
  "severity": "Moderate",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
  "cwe": "Out-of-bounds Read",
  "epss": 0.00145,
  "epssPercentile": 0.03808,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-39855",
  "fixes": [
    {
      "platform": "linux",
      "product": "osslsigncode",
      "release": "Debian 14",
      "fixedVersion": "2.13-1",
      "fix": "DEBIAN-CVE-2026-39855",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-39855",
      "released": "2026-04-09T17:16:29Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}