ZeroDay Findings
Sign inSign up

Findings

CVE-2020-0601

Microsoft Windows CryptoAPI Spoofing Vulnerability

Published Jan 14, 2020 · updated Jun 16, 2026 · microsoft windows 10 1507

Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 14, 2020 · Catalog

    Detected

    Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-i

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-i

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe golang/goversion unspecified
  • cpe microsoft/windows 10 1507version unspecified
  • cpe microsoft/windows 10 1607version unspecified
  • cpe microsoft/windows 10 1709version unspecified
  • cpe microsoft/windows 10 1803version unspecified
  • vendor Microsoft Windowsversion unspecified

Sources

  • CISA KEVCVE-2020-0601

    Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-i

    cisa.gov
  • CVE.orgCVE-2020-0601

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2020-0601

    30-day exploitation probability 89.4%

    first.org
  • Exploit Database47933

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2020-0601

    A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file wa

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm Securityhttp://packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References