CVE-2026-39853: Osslsigncode Memcpy Buffer Overflow
Unbounded memcpy of an ASN.1 SpcIndirectDataContent digest into a buffer. This copies data trusting the `messageDigest->digest->length` field, which is controlled by the attacker. If the destination array has a fixed boundary (like EVP_MAX_MD_SIZE), this will cause a buffer overflow. Verify the length fits the destination buffer before moving memory.
Cgreprules fetch cve-2026-39853-osslsigncode-memcpy-buffer-overflow --engine opengrepDescription
Unbounded memcpy of an ASN.1 SpcIndirectDataContent digest into a buffer. This copies data trusting the `messageDigest->digest->length` field, which is controlled by the attacker. If the destination array has a fixed boundary (like EVP_MAX_MD_SIZE), this will cause a buffer overflow. Verify the length fits the destination buffer before moving memory.
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.