CVE-2012-0151: Microsoft Windows Authenticode Signature Verification PE Digest Validation Flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw allows code execution via a tampered signed binary, is listed in CISA KEV, and has a very high EPSS score, though exploitation requires local user interaction.

What it is

The Authenticode Signature Verification function (WinVerifyTrust) in multiple Microsoft Windows versions fails to properly validate the digest of a signed portable executable file. A modified PE file with appended content can retain a valid-looking signature, allowing the tampered file to pass signature checks. This undermines the trust placed in signed binaries and enables code execution from a file that appears legitimately signed.

Impact

An attacker can execute arbitrary code in the context of the user who opens or runs the tampered signed file. Integrity and confidentiality of the affected system are fully compromised.

Attack surface

Reached locally when a user opens or executes a crafted PE file, per the CVSS vector AV:L/UI:R with no privileges required. No remote network vector and no authentication are needed; success depends on user interaction.

Exploitation

CVE-2012-0151 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-06-08), and EPSS shows a 30-day exploitation probability of 0.8878 (99.8th percentile), indicating active exploitation is expected. No ransomware campaign use is documented.

What to do

• Apply the Microsoft security update for MS12-024 (KB2653956) to all affected Windows versions.
• Prioritize patching of Windows XP, Server 2003, Vista, Server 2008, Windows 7, and Windows 8 Consumer Preview systems, which are all listed as affected.
• Where legacy systems cannot be patched, restrict execution of untrusted PE files and enforce application allowlisting.
• Verify Authenticode signatures using an updated verification path that checks the full file digest, not just the embedded signature.

Detection

• Monitor for execution of PE files whose signature validates but whose file size or appended content differs from the signed payload.
• Alert on process creation events for binaries launched from user-writable directories such as Downloads, Temp, or email attachment folders.
• Audit Windows event logs and EDR telemetry for WinVerifyTrust-related signature validation anomalies on legacy hosts.
• Track unpatched Windows XP/2003/Vista/2008/7 systems still present in the environment as high-risk assets.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.