CVE-2020-1464

A spoofing vulnerability exists when Windows incorrectly validates file signatures, aka ‘Windows Spoofing Vulnerability’.

Recent assessments:

zeroSteiner at August 11, 2020 9:33pm UTC reported:

A vulnerability exists within Windows that can allow file signature validation to be bypassed. This would allow an attacker to load and execute PE files without having signed them, possibly masquerading as a legitimate signature. This would be useful if the system the attacker is on requires signatures for all files or if the attacker wanted to load a library into a process where signatures are enforced.

This would not grant elevated privileges without being combined with an additional primitive.

While this is being actively exploited in the wild, at this time there are few public details on the vulnerability.

Assessed Attacker Value: 2
Assessed Attacker Value: 2Assessed Attacker Value: 3