Actively exploited in the wild
Microsoft Windows CryptoAPI Spoofing Vulnerability
Microsoft - Windows · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-0601
HighCVSS 8.1KEVSummary
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source.
Risk Assessment
An attacker could sign malicious software with certificates that appear trusted, making detection harder and potentially leading to installation of malicious code. This could also undermine trust in code-signing and certificate mechanisms on Windows.
Recommendation
Immediately install the Windows security updates released by Microsoft in January 2020. Additionally, verify whether any unusual ECC certificates are present in the environment.
Other vulnerabilities in Windows CryptoAPI
See all- CVE-2026-55144High
Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform tampering locally.
- CVE-2023-35339High
A vulnerability in Windows CryptoAPI allows for a Denial of Service (DoS) attack, potentially leading to service unavailability. An attacker can exploit this flaw to disrupt system operations.
Original NVD description (English source)
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.