{"id":"EUVD-2020-2099","enisaUuid":"5338ca90-5985-3c5a-b63d-321090819f32","description":"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka \u0027Windows CryptoAPI Spoofing Vulnerability\u0027.","datePublished":"Jan 14, 2020, 11:11:20 PM","dateUpdated":"Oct 21, 2025, 11:35:53 PM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","references":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601\nhttp://packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html\nhttp://packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html\n","aliases":"CVE-2020-0601\nGHSA-82jc-cv6x-r223\n","assigner":"microsoft","epss":89.08,"exploitedSince":"Nov 3, 2021, 12:00:00 AM","enisaIdProduct":[{"id":"00ed8e8a-1395-31f7-838c-872e5a20bfbb","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1803 for ARM64-based Systems"},{"id":"19a437fb-8d40-3a02-b877-46f8aef31813","product":{"name":"Windows 10 Version 1903 for 32-bit Systems","vendor":{"name":"Microsoft"}},"product_version":"unspecified"},{"id":"23c7c8fb-fb38-3182-ab97-4069e4334ab6","product":{"name":"Windows Server, version 1909 (Server Core installation)","vendor":{"name":"Microsoft"}},"product_version":"unspecified"},{"id":"261b7169-f387-393d-92a4-683c27d725a5","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1607 for x64-based Systems"},{"id":"2f535133-3de1-3d28-8ba1-e89d46703325","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 for 32-bit Systems"},{"id":"30ee1cb4-3f9c-3b7a-93d6-de26936e748d","product":{"name":"Windows Server","vendor":{"name":"Microsoft"}},"product_version":"2019"},{"id":"4510acb7-d0b8-385c-8194-32b0db1a8c75","product":{"name":"Windows 10 Version 1909 for ARM64-based Systems","vendor":{"name":"Microsoft"}},"product_version":"unspecified"},{"id":"49698121-0b61-3bce-a041-a47b4953f57d","product":{"name":"Windows 10 Version 1903 for ARM64-based Systems","vendor":{"name":"Microsoft"}},"product_version":"unspecified"},{"id":"4d461f3d-a641-3c27-b5ce-4c63b7d7385a","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1709 for x64-based Systems"},{"id":"52210fa6-a57e-3213-9e8e-d66b06da8bb8","product":{"name":"Windows 10 Version 1909 for x64-based Systems","vendor":{"name":"Microsoft"}},"product_version":"unspecified"},{"id":"534a6c73-6607-3193-8eaa-7d3d7e27a19e","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 for x64-based Systems"},{"id":"54a0c485-53ca-3588-ab7e-562aa689b409","product":{"name":"Windows Server","vendor":{"name":"Microsoft"}},"product_version":"2019  (Core installation)"},{"id":"6dbe0bb7-b377-3751-ab30-4e87209e7813","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1803 for 32-bit Systems"},{"id":"70927e13-fc6b-380b-ac6f-940d37d1f30f","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1803 for x64-based Systems"},{"id":"81107a46-3584-335c-9515-159bef9a15f9","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1809 for 32-bit Systems"},{"id":"8987cf87-e518-3317-b01a-3f862680f9f7","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1709 for ARM64-based Systems"},{"id":"8dccf595-ed38-3830-a773-11b58b190ef8","product":{"name":"Windows 10 Version 1903 for x64-based Systems","vendor":{"name":"Microsoft"}},"product_version":"unspecified"},{"id":"905c13b7-0fcf-38d3-93a1-b7cb473f61f4","product":{"name":"Windows Server, version 1903 (Server Core installation)","vendor":{"name":"Microsoft"}},"product_version":"unspecified"},{"id":"c1f4051a-679d-3b36-9def-fcb90a247af3","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1809 for ARM64-based Systems"},{"id":"c8054f89-11e4-379e-bb1f-c02fc821c22f","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1607 for 32-bit Systems"},{"id":"cc23bb79-a7cf-3216-9d87-2988960ff981","product":{"name":"Windows Server","vendor":{"name":"Microsoft"}},"product_version":"version 1803  (Core Installation)"},{"id":"d741ab35-3a0a-3931-aded-fb5ca2e397b9","product":{"name":"Windows Server","vendor":{"name":"Microsoft"}},"product_version":"2016  (Core installation)"},{"id":"e9cef296-cac5-3c12-9105-cb5d5de514cd","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1709 for 32-bit Systems"},{"id":"fa5544b7-add9-3832-acfd-e3339355fc97","product":{"name":"Windows 10 Version 1909 for 32-bit Systems","vendor":{"name":"Microsoft"}},"product_version":"unspecified"},{"id":"fc397b9a-01ca-3fe5-bf36-2f4cb2be6f19","product":{"name":"Windows Server","vendor":{"name":"Microsoft"}},"product_version":"2016"},{"id":"fd14627f-2076-34fb-b707-d644edc1ffd7","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1809 for x64-based Systems"}],"enisaIdVendor":[{"id":"2d737c6b-1215-36e9-9ce8-54a64832a15e","vendor":{"name":"Microsoft"}}],"enisaIdVulnerability":[{"id":"79a5ecb8-fa22-31b0-bf86-58f961b3c52b","vulnerability":{"id":"CVE-2020-0601","description":"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka \u0027Windows CryptoAPI Spoofing Vulnerability\u0027.","datePublished":"Jan 14, 2020, 11:11:20 PM","dateUpdated":"Oct 21, 2025, 11:35:53 PM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","references":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601\nhttp://packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html\nhttp://packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html\n","enisa_id":"EUVD-2020-2099\n","assigner":"microsoft","epss":89.08,"dataProcessed":"Nov 11, 2026, 7:23:09 AM","exploitedSince":"Nov 3, 2021, 12:00:00 AM","vulnerabilityProduct":[{"id":"09b6aeaa-7f0a-3030-a4d2-d8c3155e1934","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 for 32-bit Systems"},{"id":"0cedc1f9-1c2c-3a78-9659-53008f93357a","product":{"name":"Windows Server","vendor":{"name":"Microsoft"}},"product_version":"2016  (Core installation)"},{"id":"181411f5-6f2b-3fe2-858a-62cd902ca071","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1709 for x64-based Systems"},{"id":"18c5ffd8-1278-3ba8-9bc5-f428815cef45","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1709 for ARM64-based Systems"},{"id":"1e28d7d7-5800-3e62-a8f3-3a1ccb995a7e","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1607 for x64-based Systems"},{"id":"1ea19707-ef34-3f0c-95c8-214a7fe09d3a","product":{"name":"Windows Server","vendor":{"name":"Microsoft"}},"product_version":"2016"},{"id":"24fd4812-3a80-330f-918d-b1bf87f8d36a","product":{"name":"Windows 10 Version 1909 for ARM64-based Systems","vendor":{"name":"Microsoft"}},"product_version":"unspecified"},{"id":"2b70514f-659a-3e1e-a220-245251658477","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 for x64-based Systems"},{"id":"2bdbcd57-251c-3bdf-be9f-97f56afddf50","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1709 for 32-bit Systems"},{"id":"3164dd85-5e13-3b84-94d1-eaeded1aaef1","product":{"name":"Windows Server","vendor":{"name":"Microsoft"}},"product_version":"version 1803  (Core Installation)"},{"id":"471e6132-7a07-333f-9cf0-cfddca3ef6fa","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1607 for 32-bit Systems"},{"id":"4e2702b2-262a-3f4f-93d2-299234e3b422","product":{"name":"Windows 10 Version 1909 for 32-bit Systems","vendor":{"name":"Microsoft"}},"product_version":"unspecified"},{"id":"628e34e9-0f22-3851-a238-8a0a5b63f732","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1803 for ARM64-based Systems"},{"id":"6437051b-bc31-3e61-ad32-8bb5d4488ca5","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1803 for x64-based Systems"},{"id":"684d74d7-7155-3c25-8c31-a3e2ca44429e","product":{"name":"Windows 10 Version 1903 for ARM64-based Systems","vendor":{"name":"Microsoft"}},"product_version":"unspecified"},{"id":"69ebec84-736f-38db-93fb-3e034bc1088a","product":{"name":"Windows 10 Version 1903 for x64-based Systems","vendor":{"name":"Microsoft"}},"product_version":"unspecified"},{"id":"8c29e60b-4d0b-3941-a9c6-2cb3a72038b8","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1809 for 32-bit Systems"},{"id":"b02bcae9-aad6-3d90-a75c-5bbaaa4adca4","product":{"name":"Windows Server, version 1903 (Server Core installation)","vendor":{"name":"Microsoft"}},"product_version":"unspecified"},{"id":"b41bba27-a136-307d-b842-9a00da807553","product":{"name":"Windows Server, version 1909 (Server Core installation)","vendor":{"name":"Microsoft"}},"product_version":"unspecified"},{"id":"bb87faa7-2df2-3d01-b11c-1493c42c05f7","product":{"name":"Windows 10 Version 1903 for 32-bit Systems","vendor":{"name":"Microsoft"}},"product_version":"unspecified"},{"id":"be2b7a4a-c1d1-3c6a-879b-708c6aa780f5","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1809 for ARM64-based Systems"},{"id":"c5a1c0cc-0c2c-3c46-93ec-771b6478c204","product":{"name":"Windows 10 Version 1909 for x64-based Systems","vendor":{"name":"Microsoft"}},"product_version":"unspecified"},{"id":"ccca79a1-eecc-3917-8580-56caa7b98b1c","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1803 for 32-bit Systems"},{"id":"d5bea507-c8d6-3a81-be46-d1e76a5479e3","product":{"name":"Windows Server","vendor":{"name":"Microsoft"}},"product_version":"2019  (Core installation)"},{"id":"e1eae52c-f760-3d86-a78a-a8db17b16941","product":{"name":"Windows","vendor":{"name":"Microsoft"}},"product_version":"10 Version 1809 for x64-based Systems"},{"id":"f6f4a933-7d70-3ad9-a7e9-bb6e8117a9cb","product":{"name":"Windows Server","vendor":{"name":"Microsoft"}},"product_version":"2019"}],"vulnerabilityVendor":[{"id":"ddfda82a-a6ed-3c47-b75f-5a623fc3e38c","vendor":{"name":"Microsoft"}}]}},{"id":"ac5ce3a9-6b47-3bdd-af78-706ab26f2da4","vulnerability":{"id":"GHSA-82jc-cv6x-r223","description":"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka \u0027Windows CryptoAPI Spoofing Vulnerability\u0027.","datePublished":"May 24, 2022, 5:06:15 PM","dateUpdated":"Oct 22, 2025, 12:31:49 AM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2020-0601\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601\nhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve\u003dCVE-2020-0601\nhttp://packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html\nhttp://packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html\n","enisa_id":"EUVD-2020-2099\n","aliases":"CVE-2020-0601\nGHSA-82jc-cv6x-r223\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:23:21 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}