All vulnerabilities
CVE-2013-3900

Microsoft WinVerifyTrust function Remote Code Execution

Microsoft WinVerifyTrust function
Open in ThreatlineRecord JSON
CVSS
5.5Medium
ExploitationExploited in the wildAdded to KEV 10 Jan 2022CISA KEV
Exploit odds (EPSS)44.6%Chance of exploitation activity in the next 30 days, higher than 98% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Federal deadline10 Jul 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 11 Dec 2013, 00:00 UTCPublishedCVE List
  2. 10 Jan 2022Added to CISA KEVCISA KEV

Description

A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.

Text from CVE List

Affected versions 27

  • Windows 10 Version 1809affected: N/ACVE List
  • Windows Server 2019affected: N/ACVE List
  • Windows Server 2019 (Server Core installation)affected: N/ACVE List
  • Windows Server 2022affected: N/ACVE List
  • Windows 11 version 21H2affected: N/ACVE List
  • Windows 10 Version 21H2affected: N/ACVE List
  • Windows 11 version 22H2affected: N/ACVE List
  • Windows 10 Version 22H2affected: N/ACVE List
  • Windows Server 2025 (Server Core installation)affected: N/ACVE List
  • Windows 11 version 22H3affected: N/ACVE List
  • Windows 11 Version 23H2affected: N/ACVE List
  • Windows Server 2022, 23H2 Edition (Server Core installation)affected: N/ACVE List
  • Windows 11 Version 24H2affected: N/ACVE List
  • Windows Server 2025affected: N/ACVE List
  • Windows 10 Version 1507affected: N/ACVE List
  • Windows 10 Version 1607affected: N/ACVE List
  • Windows Server 2016affected: N/ACVE List
  • Windows Server 2016 (Server Core installation)affected: N/ACVE List
  • Windows Server 2008 Service Pack 2affected: N/ACVE List
  • Windows Server 2008 Service Pack 2 (Server Core installation)affected: N/ACVE List
  • Windows Server 2008 Service Pack 2affected: N/ACVE List
  • Windows Server 2008 R2 Service Pack 1affected: N/ACVE List
  • Windows Server 2008 R2 Service Pack 1 (Server Core installation)affected: N/ACVE List
  • Windows Server 2012affected: N/ACVE List
  • Windows Server 2012 (Server Core installation)affected: N/ACVE List
  • Windows Server 2012 R2affected: N/ACVE List
  • Windows Server 2012 R2 (Server Core installation)affected: N/ACVE List

References 4