SummaryAI-written · claude-haiku-5-5AI-written · claude-haiku-5-5Written by a language model from the source data on this page. Not reviewed by a person. Generated 23 Oct 2026.
A spoofing flaw in Microsoft Windows lies in how the Windows CryptoAPI component (Crypt32.dll) validates Elliptic Curve Cryptography certificates. An attacker can exploit it over the network without authentication, but needs a user to interact with the malicious content, by using a spoofed code-signing certificate to sign a malicious executable so it appears to come from a trusted source.
Official description · NVDSource dataSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. Copied from NVD.
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown.Breakdown
78.6 / 100
Exploited
Yes, in CISA KEV
Reports
0
Tactics
2/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited the day it was disclosed. Public exploit code (PoC-in-GitHub) was available the same day.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
7 fixes in stdlib over 11 months. The latest fix listed for stdlib is 1.14.5.
Fixes in stdlibGo package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
2 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order, 2 cited passagesAIAI-writtenWritten by a language model from the source data on this page. Not reviewed by a person.2
Stealth
MasqueradingT1036Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
AI-written · claude-haiku-5-5AI-written · claude-haiku-5-5Written by a language model from the source data on this page. Not reviewed by a person. claude-haiku-5-5: Spoofed signature makes malware appear legitimate.AI mapping from the description · primary impact
Spoofed signature makes malware appear legitimate
making it appear the file was from a trusted, legitimate source
Code SigningT1553.002Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
AI-written · claude-haiku-5-5AI-written · claude-haiku-5-5Written by a language model from the source data on this page. Not reviewed by a person. claude-haiku-5-5: Forged certificate signs malicious executable; subverts code-signing trust.AI mapping from the description · how it is exploited
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
Exploit Public-Facing ApplicationT1190SourceSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. CTID attack_to_cve (Phase 1).needs user interaction; not a public-facing exploit
Exploitation for Client ExecutionT1203SourceSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. CTID attack_to_cve (Phase 1).CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
Detection
0 rules for this CVE · 41 general rules for its techniques
Rules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2020-0601 directly.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
From GitHub Security Advisories and OSVSourceSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. GitHub Security Advisories and OSV.
Set the version to Go 1.26.9 or later in your Go toolchain.
First fixed in 1.13.7 for CVE-2020-0601.
Affected versions, by release line
If you run
Upgrade to
1.13.0-0 up to 1.13.7
1.26.9first fix for this CVE: 1.13.7
All versions before 1.12.16
Still affected on this line by CVE-2023-45288 (fixed in 1.21.9, a newer line); CVE-2026-56857 (fixed in 1.26.9, a newer line); CVE-2026-78663 (fixed in 1.26.9, a newer line).
1.12.16
“Up to” means the second version is the fix and is not affected.