Unrated severityCISA KEVNVD Advisory· Published Jan 14, 2020· Updated Oct 21, 2025
CVE-2020-0601
CVE-2020-0601
Description
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.
Affected products
10- Microsoft/Windows 10 Version 1903 for 32-bit Systemsv5Range: unspecified
- Microsoft/Windows 10 Version 1903 for ARM64-based Systemsv5Range: unspecified
- Microsoft/Windows 10 Version 1903 for x64-based Systemsv5Range: unspecified
- Microsoft/Windows 10 Version 1909 for 32-bit Systemsv5Range: unspecified
- Microsoft/Windows 10 Version 1909 for ARM64-based Systemsv5Range: unspecified
- Microsoft/Windows 10 Version 1909 for x64-based Systemsv5Range: unspecified
- Microsoft/Windows Serverv5Range: version 1803 (Core Installation)
- Microsoft/Windows Server, version 1903 (Server Core installation)v5Range: unspecified
- Microsoft/Windows Server, version 1909 (Server Core installation)v5Range: unspecified
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.htmlmitrex_refsource_MISC
- packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.htmlmitrex_refsource_MISC
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.