Cyber Posture

CVE-2025-70888

Critical

Published: 25 March 2026

Published
25 March 2026
Modified
02 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 36.5th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c component

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Flaw remediation requires updating osslsigncode to a patched version beyond v2.10, directly eliminating the privilege escalation vulnerability.

AC-6 Least Privilege good match
prevent

Least privilege enforcement ensures the osslsigncode process runs with minimal necessary privileges, preventing successful escalation to higher privileges.

CM-10 Software Usage Restrictions good match
prevent

Software usage restrictions prohibit deployment or execution of vulnerable osslsigncode versions v2.10 and earlier on systems.

Security SummaryAI

CVE-2025-70888 is a critical vulnerability in the osslsigncode tool developed by mtrojnar, affecting versions 2.10 and earlier. The issue resides in the osslsigncode.c component and stems from improper privilege management (CWE-269), earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Published on March 25, 2026, it enables a remote attacker to escalate privileges when the tool is used for signing binaries or related cryptographic operations.

A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows full compromise of the affected system, granting high-impact access to confidentiality, integrity, and availability through privilege escalation from the tool's execution context.

Mitigation details are available in upstream repositories, including GitHub issue #475 and pull request #477 in the mtrojnar/osslsigncode project, which address the flaw. A related discussion appears in ralphje/signify issue #60. Security practitioners should update to a version incorporating the fix from PR #477 and audit uses of osslsigncode in signing workflows.

Details

CWE(s)
CWE-269

Affected Products

osslsigncode project
osslsigncode
≤ 2.10

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CVE-2025-70888 is a remote, unauthenticated privilege escalation vulnerability (AV:N/AC:L/PR:N), directly enabling T1068 (Exploitation for Privilege Escalation) and facilitating initial access via T1190 (Exploit Public-Facing Application).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References