CVE coverage
View on NVD →
CVE-2020-0601
CVSS 8.1
Actively exploited (KEV)
2 detections found
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall) | production | 2026-09-18 |
| sigma | Audit CVE Event | test | 2022-10-22 |