Vulnerability record · CVE-2020-1464 · published 17 August 2020
CVE-2020-1464: Windows file signature validation spoofing allows loading of improperly signed files
Microsoft · Windows 10 1507
Windows incorrectly validates file signatures, so a crafted file can be treated as properly signed. This lets an attacker bypass the security features that are meant to block improperly signed files from loading. The flaw affects a broad range of Windows client and server releases.
Description
A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass security features and load improperly signed files. In an attack scenario, an attacker could bypass security features intended to prevent improperly signed files from being loaded. The update addresses the vulnerability by correcting how Windows validates file signatures.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityIt is in CISA KEV with a high EPSS score and an exploit-tagged reference, and it affects a wide range of Windows versions, though it requires local access and low privileges.
What it is
Windows incorrectly validates file signatures, so a crafted file can be treated as properly signed. This lets an attacker bypass the security features that are meant to block improperly signed files from loading. The flaw affects a broad range of Windows client and server releases.
Impact
An attacker can bypass signature-based security controls and load improperly signed files, which can lead to code execution or other unauthorized actions in the context of the affected system. The CVSS vector indicates high confidentiality, integrity and availability impact.
Attack surface
The vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker needs local access and some existing privilege on the target. It is not remotely reachable over the network per the supplied vector.
Exploitation
CVE-2020-1464 is listed in CISA KEV (added 2021-11-03) and has an EPSS 30-day probability of 0.38946 (98.5th percentile), and a reference is tagged Exploit, indicating known exploitation activity.
What to do
- Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com) to all affected Windows client and server versions.
- Prioritize patching internet-facing and high-value Windows Server 2008/2012/2016/2019 and Windows 10/8.1/7 systems, since the flaw spans many supported releases.
- Restrict local interactive and service account privileges to reduce the low-privileged local access the vector requires.
- Enforce application allowlisting and code-signing controls so improperly signed binaries cannot execute even if signature validation is bypassed.
- Monitor for and remove unauthorized or suspiciously signed executables and JAR/archive files that may be used with this bypass.
Detection
- Hunt for execution of binaries or archives with invalid, mismatched or appended signatures, especially files that pass signature checks unexpectedly.
- Review Windows event and EDR telemetry for processes loading files from unusual paths or with anomalous signature metadata.
- Correlate with known malicious JAR-appended file activity described in the VirusTotal reference.
- Audit systems for missing the Microsoft update associated with CVE-2020-1464 and track patch compliance.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2020-1464 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "Microsoft Windows Spoofing Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 3 May 2022.
Affected products
18 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
Windows 10 1507 Microsoft
Windows 10 1607 Microsoft
Windows 10 1709 Microsoft
Windows 10 1803 Microsoft
Windows 10 1809 Microsoft
Windows 10 1903 Microsoft
Windows 10 1909 Microsoft
Windows 10 2004 Microsoft
Windows 7 Microsoft
Windows 8.1 Microsoft
Windows Rt 8.1 Microsoft
Windows Server 1903 Microsoft
Windows Server 1909 Microsoft
Windows Server 2004 Microsoft
Windows Server 2008 Microsoft
Windows Server 2012 Microsoft
Windows Server 2016 Microsoft
Windows Server 2019 Microsoft
References
| Link | Tags |
|---|---|
| https://blog.virustotal.com/2019/01/distribution-of-malicious-jar-appended.html | Third Party Advisory |
| https://krebsonsecurity.com/2020/08/microsoft-put-off-fixing-zero-day-for-2-years/ | Issue TrackingThird Party Advisory |
| https://medium.com/%40TalBeerySec/glueball-the-story-of-cve-2020-1464-50091a1f98bd | ExploitThird Party Advisory |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1464 | PatchVendor Advisory |
| https://blog.virustotal.com/2019/01/distribution-of-malicious-jar-appended.html | Third Party Advisory |
| https://krebsonsecurity.com/2020/08/microsoft-put-off-fixing-zero-day-for-2-years/ | Issue TrackingThird Party Advisory |
| https://medium.com/%40TalBeerySec/glueball-the-story-of-cve-2020-1464-50091a1f98bd | ExploitThird Party Advisory |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1464 | PatchVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1464 | US Government Resource |
Track CVE-2020-1464 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-1464), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
