Attackers could exploit the vulnerability with malformed signatures, allowing downloaded programs to bypass mark-of-the-web flags.