CVE-2012-0151: Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability

Vulnerability summary

CVE-2012-0151 is a high (CVSS 9.3) Improper Input Validation vulnerability in Microsoft Windows. It is known to be exploited: CISA lists it, first on 08-06-2022. EPSS estimates a 87.72% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities.

Timeline

1. 10-04-2012
   PublishedVulnerability first disclosed.
2. 08-06-2022
   Added to CISA KEVMicrosoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability
3. 22-06-2022
   CISA remediation dueApply updates per vendor instructions.
4. 22-10-2025
   Last modifiedVulnerability information updated.

Description

The Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute arbitrary code via a modified file with additional content, aka "WinVerifyTrust Signature Validation Vulnerability."

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.