CVE-2020-0601

8.1 highKEVEPSS 89%

High (8.1) in Microsoft Windows. In CISA KEV since 2021-11-03. EPSS 89% chance of exploitation in the next 30 days. Fixed in stdlib 1.12.16, 1.13.7.

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.

Severity

CVSS 3.1

8.1 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS: 89% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2021-11-03, due 2022-05-03
CWE: CWE-295
Published: 2020-01-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

golang:go
microsoft:windows_10_1507
microsoft:windows_10_1607
microsoft:windows_10_1709
microsoft:windows_10_1803
microsoft:windows_10_1809
microsoft:windows_10_1903
microsoft:windows_10_1909
microsoft:windows_server_1803
microsoft:windows_server_1903
microsoft:windows_server_1909
microsoft:windows_server_2016
microsoft:windows_server_2019

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GO-2022-0535	Go	stdlib	<1.12.16 >=1.13.0-0 <1.13.7	1.12.16, 1.13.7

References

Check your stack JSON