CVE-2020-0601VulnerabilityPublished 11/03/2021Updated 10/24/2026
CVE-2020-0601: Microsoft Windows CryptoAPI Spoofing Vulnerability
Affects Microsoft WindowsSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 11/03/2021
- KEV deadline
- 05/03/2022
- EPSS
- 89.4% chance of exploitation in 30 days – higher than 99% of CVEs
What to do
CISA required action
Apply updates per vendor instructions.
Description
CVE-2020-0601 is a spoofing vulnerability in Microsoft Windows CryptoAPI (Crypt32.dll) related to the validation of Elliptic Curve Cryptography certificates. An attacker can exploit this flaw by using a spoofed code-signing certificate to make malicious executables appear as if they are from trusted sources. This vulnerability also enables man-in-the-middle attacks and decryption of confidential information on user connections. It is known as CurveBall and has been exploited in the wild.