Loading vulnerability…
Windows WinVerifyTrust Signature Validation Vulnerability
CVE-2013-3900 is an Authenticode signature-verification vulnerability in the Microsoft Windows WinVerifyTrust function. Insufficient validation of portable executable (PE) certificate data allows an attacker to add malicious code or other data to unverified portions of an existing signed executable without invalidating its apparent signature. Exploitation requires a user or application to run or install a specially crafted signed PE file, with an execution mechanism that processes the embedded malicious content. Successful exploitation permits code execution with the privileges of the launching context. Microsoft's stricter signature-verification behavior remains opt-in, including on Windows 10 and Windows 11.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attackers can conceal malicious payloads in apparently trusted signed binaries, undermining security decisions that rely on Authenticode signature validity. Successful execution can compromise confidentiality, integrity, and availability within the launching account's permissions. Execution with administrative privileges can permit complete system compromise, including software installation, data access or destruction, and creation of privileged accounts. Exploitation has been observed in Zloader infections, the 3CX supply-chain attack, and espionage malware loaders.
If you can’t patch tonight, do this now.
Use least-privileged accounts to limit the consequences of malicious code execution. Restrict execution of untrusted installers and downloaded executables, and do not treat a valid digital signature as sufficient evidence of safety. Where operationally feasible, disable or restrict mshta.exe to disrupt documented script-execution chains abusing signed PE files; this does not address every exploitation mechanism.
Patch, then assume compromise.
For affected legacy Windows releases, install the applicable MS13-098 security update, KB2893294, and enable stricter Authenticode verification. Windows 10 and Windows 11 already incorporate the supporting code and require configuration rather than a separate update for this feature. Set EnableCertPaddingCheck to 1 under HKLM\Software\Microsoft\Cryptography\Wintrust\Config and, on 64-bit systems, also under HKLM\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config, following Microsoft's current configuration guidance. Installing the update alone does not enable enforcement. Test compatibility before deployment: stricter verification treats nonconforming signed binaries as unsigned and may affect installers. Software publishers should ensure installers extract executable content only from validated portions of signed files.
2 exploits validated by Mallory's analysis. Hidden: 11 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.