ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2013-3900

Microsoft WinVerifyTrust function Remote Code Execution

Published Dec 10, 2013 · catalog updated Oct 8, 2026 · Microsoft WinVerifyTrust function

Patch now

CVE-2013-3900 is in the CISA known-exploited catalog, due Jul 10, 2022. Confirm Microsoft WinVerifyTrust function against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Gaps on this record

  • No version range is stored. A customer cannot check an installed version against this record.
Severity
Medium5.5
Known exploitation
CISA KEV and VulnCheck KEV
EPSS
44.65%
Remediation
Remediation guidance
Affected products
cpe microsoft/windows 10 1507 · cpe microsoft/windows 10 1607 · cpe microsoft/windows 10 1809 · cpe microsoft/windows 10 1909 · cpe microsoft/windows 10 20h2 · vendor Microsoft WinVerifyTrust function

Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11. While the format is different from the original CVE published in 2013, except for clarifications about how to configure the EnableCertPaddingCheck registry value, the information herein remains unchanged from the original text published on December 10, 2013, Microsoft does not plan to enforce the stricter verification behavior as a default functionality on supported releases of Microsoft Windows. This behavior remains available as an opt-in feature via reg key setting, and is available on supported editions of Windows released since December 10, 2013. This includes all currently supported versions of Windows 10 and Windows 11. The supporting code for this reg key was incorporated at the time of release for Windows 10 and Windows 11, so no security update is required; however, the reg key must be set. See the Security Updates table for the list of affected software. Vulnerability Description A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for portable executable (PE) files. An anonymous attacker could exploit the vulnerability by modifying an existing signed executable file to leverage unverified portions of the file in such a way as to add malicious code to the file without invalidating the signature. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker c

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe microsoft/windows 10 1507version unspecified
  • cpe microsoft/windows 10 1607version unspecified
  • cpe microsoft/windows 10 1809version unspecified
  • cpe microsoft/windows 10 1909version unspecified
  • cpe microsoft/windows 10 20h2version unspecified
  • vendor Microsoft WinVerifyTrust functionversion unspecified
  • vendor Microsoft Windows 10 Version 1809version unspecified
  • vendor Microsoft Windows 10 Version 21H2version unspecified
  • vendor Microsoft Windows 11 version 21H2version unspecified
  • vendor Microsoft Windows 11 version 22H2version unspecified
  • vendor Microsoft Windows Server 2019version unspecified
  • vendor Microsoft Windows Server 2019 (Server Core installation)version unspecified
  • vendor Microsoft Windows Server 2022version unspecified

How to fix CVE-2013-3900

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2013-3900 is in the CISA known-exploited catalog, due Jul 10, 2022. Confirm Microsoft WinVerifyTrust function against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Which versions are affected?

Affected version ranges are not on this record. Apply updates per vendor instructions.

What should an analyst verify?

CWE-20: Improper Input Validation; CWE-347: Improper Verification of Cryptographic Signature. EPSS 44.65%. The CISA KEV listing is the exploitation evidence. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Windows security

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 10, 2013 · Catalog

    Detected

    Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11. While the format is different from the original CVE published in 2013, except for clarifications about how to configur

  2. Jan 10, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jul 10, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Oct 7, 2026 · Catalog

    Updated

    Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11. While the format is different from the original CVE published in 2013, except for clarifications about how to configur

  5. Oct 8, 2026 · CVE.org

    Updated

    Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11. While the format is different from the original CVE published in 2013, except for clarifications about how to configur

Sources

  • CISA KEVConfirmed exploitationCVE-2013-3900

    A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2013-3900

    Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2013-3900

    30-day exploitation probability 44.6%

    first.org
  • NIST NVDVulnerability recordCVE-2013-3900

    Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11

    nvd.nist.gov
  • VulnCheck KEVConfirmed exploitationCVE-2013-3900

    A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.

    vulncheck.com

References

Freshness

Last verified in this catalog Oct 17, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.