osslsigncode, a tool for Authenticode signing and timestamping, contains a stack buffer overflow vulnerability in versions before 2.12. The issue arises because the code copies the digest value from a parsed SpcIndirectDataContent structure into a fixed-size stack buffer (64 bytes) without validating that the source length fits, leading to potential overflow. This vulnerability is present in multiple signature verification paths including PE, MSI, CAB, and script files. An attacker can exploit this by crafting a malicious signed file with an oversized digest field, causing stack corruption during verification. The vulnerability is tracked as CVE-2026-39853 and has a CVSS 3.1 score of 7.8 (high severity). The issue is fixed in osslsigncode version 2.12.

Successful exploitation can lead to stack corruption, potentially allowing an attacker to execute arbitrary code, cause denial of service, or compromise the integrity and availability of the verification process. The vulnerability affects local users who run osslsigncode verify on crafted malicious files. There are no known exploits in the wild at this time.

Upgrade osslsigncode to version 2.12 or later, where this vulnerability is fixed. Since no official patch links or vendor advisories are provided, verify the upgrade from the official mtrojnar osslsigncode source. Avoid verifying untrusted signed files with vulnerable versions until patched.