CVE-2026-39856

osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an out-of-bounds read vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code pepagehashcalc. When processing PE sections for page hashing, the function uses...

CVE-2026-39855

osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an integer underflow vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code pepagehashcalc. When page hash processing is performed on a PE file, the function...

CVE-2026-39853

osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.12, A stack buffer overflow vulnerability exists in osslsigncode in several signature verification paths. During verification of a PKCS7 signature, the code copies the digest value from a parsed...

EUVD-2026-20942

osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.12, A stack buffer overflow vulnerability exists in osslsigncode in several signature verification paths. During verification of a PKCS7 signature, the code copies the digest value from a parsed...

PT-2026-31646

osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an integer underflow vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code pe page hash calc. When page hash processing is performed on a PE file, the function...

[SECURITY] Fedora 42 Update: osslsigncode-2.12-1.fc42

osslsigncode is a small tool that implements part of the functionality of the Microsoft tool signtool.exe - more exactly the Authenticode signing and timestamping. But osslsigncode is based on OpenSSL and cURL, and thus should be able to compile on most platforms where these exist...

[SECURITY] Fedora 43 Update: osslsigncode-2.12-1.fc43

osslsigncode is a small tool that implements part of the functionality of the Microsoft tool signtool.exe - more exactly the Authenticode signing and timestamping. But osslsigncode is based on OpenSSL and cURL, and thus should be able to compile on most platforms where these exist...

jsign:AuthenticodeExeSignerFuzzer: Security exception in net.jsign.bouncycastle.asn1.DefiniteLengthInputStream.read

Project: https://github.com/ebourg/jsign.git Detailed Report: https://oss-fuzz.com/testcase?key=5189395916652544 Project: jsign Fuzzing Engine: libFuzzer Fuzz Target: AuthenticodeExeSignerFuzzer Job Type: libfuzzerasanjsign Platform Id: linux Crash Type: Security exception Crash Address: Crash...

jsign:AuthenticodeCabSignerFuzzer: Uncaught exception in net.jsign.mscab.MSCabinetFile.getSignatures

Project: https://github.com/ebourg/jsign.git Detailed Report: https://oss-fuzz.com/testcase?key=4933341964533760 Project: jsign Fuzzing Engine: libFuzzer Fuzz Target: AuthenticodeCabSignerFuzzer Job Type: libfuzzerasanjsign Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...