CVE-2020-0601: Microsoft Windows CryptoAPI Spoofing Vulnerability
Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.
Read the original at CISA KEV Catalog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-0601Microsoft
- Related
- CVE-2026-124194: Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability Known Exploited Vulnerabilities · Nov 10, 2026CVE-2026-96951: Microsoft Windows Command Injection Vulnerability Known Exploited Vulnerabilities · Oct 13, 2026CVE-2026-65660: Microsoft Share Point Code Injection Vulnerability Known Exploited Vulnerabilities · Sep 25, 2026