Every CVE Search/ Get API key

CVE-2020-0601

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic...

8.1 HighIn KEVPublic exploitFix available

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

89.1%Up 59.0 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.1

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.

Record
CVE-2020-0601
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness
CWE-295
Updated
2026-11-02
CVE List 8.1

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.

Record
CVE-2020-0601
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
EUVDEUVD-2020-2099 8.1

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.

Record
EUVD-2020-2099
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-82jc-cv6x-r223 8.1

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic...

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.

Record
GHSA-82jc-cv6x-r223
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
CISA KEV No score

Microsoft Windows CryptoAPI Spoofing Vulnerability

Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.

Record
CVE-2020-0601
Weakness
CWE-295
Updated
2026-11-02
OSVALPINE-CVE-2020-0601 8.1

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.

Record
ALPINE-CVE-2020-0601
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-03
Show 4 moreShow less
OSVBELL-CVE-2020-0601 8.1

CVE-2020-0601 does not affect BellSoft software

Record
BELL-CVE-2020-0601
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSV 8.1

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.

Record
CVE-2020-0601
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVBIT-golang-2020-0601 No score

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.

Record
BIT-golang-2020-0601
Updated
2026-11-02
OSVGO-2022-0535 No score

Certificate validation bypass on Windows in crypto/x509

A Windows vulnerability allows attackers to spoof valid certificate chains when the system root store is in use.

A workaround is present in Go 1.12.6+ and Go 1.13.7+, but affected users should additionally install the Windows security update to protect their system.

See https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-0601 for details on the Windows vulnerability.

Record
GO-2022-0535
Updated
2026-11-02

Affected products

Show 11 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
containerd
Alpine:v3.11
 before 1.3.3-r0
1.3.3-r0
containerd
Alpine:v3.12
 before 1.3.3-r0
1.3.3-r0
containerd
Alpine:v3.13
 before 1.3.3-r0
1.3.3-r0
containerd
Alpine:v3.14
 before 1.3.3-r0
1.3.3-r0
containerd
Alpine:v3.15
 before 1.3.3-r0
1.3.3-r0
containerd
Alpine:v3.16
 before 1.3.3-r0
1.3.3-r0
containerd
Alpine:v3.17
 before 1.3.3-r0
1.3.3-r0
containerd
Alpine:v3.18
 before 1.3.3-r0
1.3.3-r0
containerd
Alpine:v3.19
 before 1.3.3-r0
1.3.3-r0
containerd
Alpine:v3.20
 before 1.3.3-r0
1.3.3-r0
Show 6 moreShow less
Affected packages
PackageAffectedFixed
containerd
Alpine:v3.21
 before 1.3.3-r0
1.3.3-r0
containerd
Alpine:v3.22
 before 1.3.3-r0
1.3.3-r0
containerd
Alpine:v3.23
 before 1.3.3-r0
1.3.3-r0
containerd
Alpine:v3.24
 before 1.3.3-r0
1.3.3-r0
golang
Bitnami
 1.12.0 up to 1.12.16, 1.13.0 up to 1.13.7
1.12.161.13.7
stdlib
Go
 before 1.12.16, 1.13.0-0 up to 1.13.7
1.12.161.13.7

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubnissan-sudo/CVE-2020-06012020-01-14
PoC in GitHub0xxon/cve-2020-06012020-01-15
PoC in GitHub0xxon/cve-2020-0601-plugin2020-01-15
Exploit-DBMicrosoft Windows - CryptoAPI (Crypt32.dll) Elliptic Curve Cryptography (ECC) Spoof Code-Signing Certificate2020-01-15
PoC in GitHubJPurrier/CVE-2020-06012020-01-15
PoC in GitHubSherlockSec/CVE-2020-06012020-01-15
PoC in GitHubkudelskisecurity/chainoffools2020-01-15
PoC in GitHubly4k/CurveBall2020-01-15
PoC in GitHubBlueTeamSteve/CVE-2020-06012020-01-16
PoC in GitHubRrUZi/Awesome-CVE-2020-06012020-01-16
Show 16 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubsaleemrashid/badecparams2020-01-16
PoC in GitHub0xxon/cve-2020-0601-utils2020-01-17
PoC in GitHubDoug-Moody/Windows10_Cumulative_Updates_PowerShell2020-01-17
PoC in GitHubMarkusZehnle/CVE-2020-06012020-01-17
PoC in GitHubYoannDqr/CVE-2020-06012020-01-17
PoC in GitHubthimelp/cve-2020-0601-Perl2020-01-18
PoC in GitHubIIICTECH/-CVE-2020-0601-ECC---EXPLOIT2020-01-19
PoC in GitHubdlee35/curveball_lua2020-01-19
PoC in GitHubAsh112121/CVE-2020-06012020-01-20
PoC in GitHubgentilkiwi/curveball2020-01-20
PoC in GitHubHans-MartinHannibalLauridsen/CurveBall2020-01-23
PoC in GitHubapodlosky/PoC_CurveBall2020-01-25
PoC in GitHubioncodes/Curveball2020-01-28
PoC in GitHubamlweems/gringotts2020-01-29
PoC in GitHubtalbeerysec/CurveBallDetection2020-02-03
PoC in GitHubyanghaoi/CVE-2020-06012020-02-03

Plus 10 more. The full list has every link.

History

History
RecordedChangedSources
exploitation
affected, aliases, referencesOSV
exploits, exploits_more
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-0601 is a high vulnerability (CVSS 8.1) in Microsoft Windows, published January 14, 2020. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 89.1%, the 99th percentile. Fixed in containerd 1.3.3-r0.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open