A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve…
Historical advisory recorded 24 Oct 2026 16:17:15 UTC. Read the latest advisory.
nvd · CVE-2020-0601
PublishedA spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.
Read the publisher's advisoryAffected versions, risk and source history
nvd · CVE-2020-0601
PublishedA spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious …
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.
Additional publisher context
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Analyzed
Weakness classifications: CWE-295
Original publisher date fields
published: 2020-01-14T23:15:30.207
lastModified: 2026-06-17T02:46:08.127
26 source CPE criteria · context only
- cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*
- cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*
- cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*
- cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*
- cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*
- cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*
- cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*
- cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*
- cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*
- cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*
- cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*
- cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
- cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
- cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*
- cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*
- cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*
- cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:arm64:*
- cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:*
- cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x86:*
- cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_1909:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
The original JSON retains the logical configuration operators, exclusions and version bounds.
- Source published
- 14 Jan 2020 23:15:30 UTC
- Source modified
- 17 Jun 2026 02:46:08 UTC
- Saved here
- 24 Oct 2026 16:17:15 UTC
- Source terms
- NIST NVD usage terms; underlying source attribution retained
Original source record · Cite this exact observation · Complete original publisher JSON
Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · [email protected] · Primary · 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary · 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS 2.0 · [email protected] · Primary · 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N