CVE-2025-70888 Privilege escalation in n/a
A remote attacker can escalate privileges in the osslsigncode tool, requiring users to upgrade to a patched version.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-70888?
CVE-2025-70888 is a critical vulnerability in n/a, published on 25 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c component
Weakness: CWE-269
Which versions are affected by CVE-2025-70888?
It affects 1 product.
Linux distribution packages (2)
osslsigncode openSUSE:Leap 16.0 | All versions | 2.13-bp160.1.1 |
osslsigncode openSUSE:Tumbleweed | All versions | 2.13-1.1 |
Products include Osslsigncode Project Osslsigncode.
How do I fix CVE-2025-70888?
Upgrade to a fixed version.
Is CVE-2025-70888 being exploited?
There is no known exploitation of CVE-2025-70888 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-39853 osslsigncode has a Stack Buffer Overflow via Unbounded Digest Copy During Signature Verification
- CVE-2023-36377 Memory corruption in n/a
- CVE-2026-39855 osslsigncode has an Integer Underflow in PE Page Hash Calculation Can Cause Out-of-Bounds Read
- CVE-2026-39856 osslsigncode has an Out-of-Bounds Read via Unvalidated Section Bounds in PE Page Hash Calculation
Sources
Also known as DEBIAN-CVE-2025-70888, GHSA-m387-6h4v-93hp, UBUNTU-CVE-2025-70888, openSUSE-SU-2026:10482-1, openSUSE-SU-2026:20473-1.