CVE-2013-3900: Windows WinVerifyTrust Authenticode signature verification RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw allows code execution via tampered signed files, is in CISA KEV with a high EPSS score, and mitigation depends on an opt-in registry setting that is not enabled by default.

What it is

CVE-2013-3900 is a remote code execution flaw in how the Windows WinVerifyTrust function verifies Authenticode signatures on portable executable files. An attacker can modify an existing signed executable to add malicious code without invalidating the signature, because unverified portions of the file are trusted. Microsoft republished the CVE to note that the stricter EnableCertPaddingCheck behavior is available as an opt-in registry setting on supported Windows 10 and Windows 11 releases, not enabled by default.

Impact

Successful exploitation gives the attacker the privileges of the user or application that runs the tampered signed file, potentially full system control if that context is administrative. The attacker can then install programs, view, change or delete data, or create accounts with full user rights.

Attack surface

Reached locally when a user or application runs or installs a specially crafted signed PE file; the CVSS vector is AV:L/AC:L/PR:N/UI:R, so no authentication is needed but user interaction is required. The flaw is in signature verification logic, not a network service.

Exploitation

CVE-2013-3900 is listed in CISA KEV (added 2022-01-10, due 2022-07-10) and has a high EPSS 30-day probability of 0.44647 (98.7th percentile), indicating observed exploitation activity. No ransomware campaign use is documented in the record.

What to do

• Apply the vendor guidance in the Microsoft Security Update Guide for CVE-2013-3900; no new binary update is required for Windows 10/11, but the EnableCertPaddingCheck registry value must be set.
• Enable EnableCertPaddingCheck on all supported Windows 10 and Windows 11 systems to enforce stricter Authenticode padding verification.
• Verify the registry setting is applied and enforced through configuration management or Group Policy across the estate.
• Restrict execution of untrusted or user-writable PE files and limit administrative rights to reduce impact if a tampered signed file is run.
• Track CISA KEV remediation deadlines and confirm closure for all affected Windows versions listed in the record.

Detection

• Monitor for execution of signed PE files that have been modified after signing, for example by comparing file hashes against known-good signed binaries.
• Audit registry configuration to confirm EnableCertPaddingCheck is present and set as intended on Windows 10 and Windows 11 endpoints.
• Review process creation and file execution telemetry for signed binaries launching from unusual or user-writable paths.
• Alert on security events tied to WinVerifyTrust signature validation failures or tampered Authenticode signatures where available.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.