A stack buffer overflow vulnerability in osslsigncode versions prior to 2.12 poses a critical risk of arbitrary code execution when processing malicious files.

This is a stack-based buffer overflow (CWE-121) caused by an unbounded memory copy when processing the digest value from a SpcIndirectDataContent structure. An unauthenticated attacker can trigger this flaw by providing a specially crafted file for verification, leading to memory corruption.

The vulnerability carries a CVSS score of 7.8, reflecting its potential for total system compromise. Successful exploitation could allow an attacker to achieve remote code execution, leading to full unauthorized access, potential data exfiltration, or complete system disruption depending on the context in which the tool is utilized.

Immediate Action: Update the osslsigncode utility to version 2.12 or higher to implement the necessary bounds checking for digest verification.

Proactive Monitoring: Monitor system logs for crashes or abnormal termination of osslsigncode processes, which may indicate attempted exploitation of the buffer overflow.

Compensating Controls: Implement strict input validation or sandboxing for any automated pipelines that process externally sourced signed files using this tool.

Public Exploit Available: Unknown.

Given the severity of potential code execution, administrators should prioritize updating osslsigncode across all build and security environments. Ensure that all automated signing or verification workflows are utilizing the patched version to prevent exploitation via malicious PE, MSI, CAB, or script files.