8.1

CVE-2020-0601: Microsoft Windows CryptoAPI Spoofing Vulnerability

CVSS: 8.1v3.1HighKEVAnalyzed
AliasesGO-2022-0535BIT-golang-2020-0601
Published 14-01-2020Last modified 21-10-2025
Open JSON

Vulnerability summary

CVE-2020-0601 is a high (CVSS 8.1) Improper Certificate Validation vulnerability in Microsoft Windows. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 89.44% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
8.1/10
010
High · v3.1 (CVE.org)
EPSS score
89.44%
0%100%
Critical · 0.00 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits1exploit-database

Timeline

  1. 14-01-2020
    PublishedVulnerability first disclosed.
  2. 03-11-2021
    Added to CISA KEVMicrosoft Windows CryptoAPI Spoofing Vulnerability
  3. 03-05-2022
    CISA remediation dueApply updates per vendor instructions.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

89.44%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 89.44% on 19-09-2026

19-09-202619-10-2026
EPSS score
89.44%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
03-11-2021
Federal due date
03-05-2022

CISA required action

Apply updates per vendor instructions.

Public exploits

1 found
  • exploit-databaselocalwindowsUnverified

    Microsoft Windows - CryptoAPI (Crypt32.dll) Elliptic Curve Cryptography (ECC) Spoof Code-Signing Certificate

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Microsoft21 products
  • windows10 Version 1803 for 32-bit Systems | 10 Version 1803 for x64-based Systems | 10 Version 1803 for ARM64-based Systems | 10 Version 1809 for 32-bit Systems | 10 Version 1809 for x64-based Systems | 10 Version 1809 for ARM64-based Systems | 10 Version 1709 for 32-bit Systems | 10 Version 1709 for x64-based Systems | 10 Version 1709 for ARM64-based Systems | 10 for 32-bit Systems | 10 for x64-based Systems | 10 Version 1607 for 32-bit Systems | 10 Version 1607 for x64-based Systems
  • windows_10_1507na
  • windows_10_1607na
  • windows_10_1709na
  • windows_10_1803na
Go1 product
  • stdlib≥ 1.13.0-0, < 1.13.7
Golang1 product
  • go≥ 1.12, < 1.12.16 | ≥ 1.13, < 1.13.7

3 vendors · 23 products

References

8 links