8.1 High Exploited

CVE-2020-0601 Microsoft Windows CryptoAPI Spoofing Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Not observed so far

Weakness CWE-295

Description

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.

Affected products and versions

Product	Affected versions	Fixed in
Windows	Versions not published
Windows Server	2019	No fix stated
Windows Server	2016	No fix stated
Windows 10 Version 1903 for 32-bit Systems	Versions not published
Windows 10 Version 1903 for x64-based Systems	Versions not published
Windows 10 Version 1903 for ARM64-based Systems	Versions not published
Windows Server, version 1903 (Server Core installation)	Versions not published
Windows 10 Version 1909 for 32-bit Systems	Versions not published
Windows 10 Version 1909 for x64-based Systems	Versions not published

Show the 2 other branches

Product	Affected versions	Fixed in
Windows Server, version 1909 (Server Core installation)	Versions not published
Windows 10 Version 1909 for ARM64-based Systems	Versions not published

References

portal.msrc.microsoft.com portal.msrc.microsoft.com
packetstormsecurity.com packetstormsecurity.com
packetstormsecurity.com packetstormsecurity.com

Timeline

Published January 14, 2020
Added to the KEV catalogue November 3, 2021
Last modified October 21, 2025

The 829 CVEs of Windows →

CVE-2025-59033 The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy 7.4 High CVE-2022-50238 The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended… 7.4 High CVE-2025-9491 Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability 7.0 High CVE-2022-40733 An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version… 5.0 Medium

Track this CVE