CVE-2013-3900— WinVerifyTrust Signature Validation Vulnerability
Quick assessment
Affected
Microsoft Windows 10 Version 1809
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Microsoft Windows是美国微软（Microsoft）公司的一套个人设备使用的操作系统。 Microsoft Windows WinVerifyTrust 函数处理可移植可执行文件(PE)的Windows Authenticode签名验证的方式中存在输入验证错误漏洞。匿名攻击者可以通过修改经过签名的现有可执行文件以利用文件的未验证部分来利用此漏洞，从而向文件添加恶意代码，而无需使签名无效。成功利用此漏洞的攻击者可以完全控制受影响的系统。攻击者可随后安装程序；查看、更改或删除数据；或者创建拥有完
In-the-Wild Activity Observed
cisa_kev · confirmed
Possible ATT&CK Techniques 3 AI
T1059 · Command and Scripting Interpreter T1059.001 · PowerShell T1218 · System Binary Proxy ExecutionAffected Version Matrix 28
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2013-3900
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WinVerifyTrust Signature Validation Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Why is Microsoft republishing a CVE from 2013?
We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11. While the format is different from the original CVE published in 2013, except for clarifications about how to configure the EnableCertPaddingCheck registry value, the information herein remains unchanged from the original text published on December 10, 2013,
Microsoft does not plan to enforce the stricter verification behavior as a default functionality on supported releases of Microsoft Windows. This behavior remains available as an opt-in feature via reg key setting, and is available on supported editions of Windows released since December 10, 2013. This includes all currently supported versions of Windows 10 and Windows 11. The supporting code for this reg key was incorporated at the time of release for Windows 10 and Windows 11, so no security update is required; however, the reg key must be set. See the Security Updates table for the list of affected software.
Vulnerability Description
A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for portable executable (PE) files. An anonymous attacker could exploit the vulnerability by modifying an existing signed executable file to leverage unverified portions of the file in such a way as to add malicious code to the file without invalidating the signature. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Exploitation of this vulnerability requires that a user or application run or install a specially crafted, signed PE file. An attacker could modify an... See more at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
密码学签名的验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Microsoft Windows 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Microsoft Windows是美国微软（Microsoft）公司的一套个人设备使用的操作系统。 Microsoft Windows WinVerifyTrust 函数处理可移植可执行文件(PE)的Windows Authenticode签名验证的方式中存在输入验证错误漏洞。匿名攻击者可以通过修改经过签名的现有可执行文件以利用文件的未验证部分来利用此漏洞，从而向文件添加恶意代码，而无需使签名无效。成功利用此漏洞的攻击者可以完全控制受影响的系统。攻击者可随后安装程序；查看、更改或删除数据；或者创建拥有完
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
II. Public POCs for CVE-2013-3900
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | Remediation for CVE-2013-3900 | https://github.com/snoopopsec/vulnerability-CVE-2013-3900 | POC Details |
| 2 | Fix WinVerifyTrust Signature Validation Vulnerability, CVE-2013-3900, QID-378332 | https://github.com/CyberCondor/Fix-WinVerifyTrustSignatureValidationVuln | POC Details |
| 3 | None | https://github.com/Securenetology/CVE-2013-3900 | POC Details |
| 4 | Powershell script that checks for cert padding in the Windows Registry and adds it if it does not exist. Meant to resolve the WinTrustVerify Vulnerability. | https://github.com/OtisSymbos/CVE-2013-3900-WinTrustVerify | POC Details |
| 5 | WinVerifyTrust Signature Validation CVE-2013-3900 Mitigation (EnableCertPaddingCheck) | https://github.com/AdenilsonSantos/WinVerifyTrust | POC Details |
| 6 | None | https://github.com/DavidBr27/CVE-2013-3900-Remediation-Script | POC Details |
| 7 | Script to make changes on registry to fix CVE-2013-3900. It comes with an option to undo in case it breaks something on your environment. | https://github.com/piranhap/CVE-2013-3900_Remediation_PowerShell | POC Details |
| 8 | None | https://github.com/pkblanks/Remediating-CVE-2013-3900-EnableCertPaddingCheck- | POC Details |
| 9 | None | https://github.com/malaya-m/cve-2013-3900-remediation-report | POC Details |
| 10 | CVE-2013-3900 WinVerifyTrust Signature | https://github.com/Sabecomoeh/CVE-2013-3900 | POC Details |
| 11 | CVE PoC | https://github.com/PREN0MEN/CVE-2013-3900-PowerShell-PoC | POC Details |
| 12 | None | https://github.com/oukridrig772/-WinVerifyTrust-Signature-Validation-CVE-2013-3900-Mitigation | POC Details |
| 13 | End-to-end remediation of CVE-2013-3900 using PowerShell and Tenable. Demonstrates vulnerability identification, registry hardening, and automated verification in an Azure environment | https://github.com/ksgassama-lab/vulnerability-remediation-cve-2013-3900 | POC Details |
| 14 | PowerShell remediation for CVE-2013-3900 (WinVerifyTrust) / Tenable Plugin 166555 using EnableCertPaddingCheck. | https://github.com/SDimitri05/cve-2013-3900-winverifytrust-mitigation | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2013-3900
请登录查看更多情报信息。
Vendor Advisories for CVE-2013-3900 (1)
-
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900 x_refsource_MISC
Other References for CVE-2013-3900 (1)
IV. Related Vulnerabilities
Same product: Windows 10 Version 1809
-
CVE-2026-69530
Windows Reliable Multicast Transport Driver (RMCAST) Remote -
CVE-2026-81354
Windows Hello Elevation of Privilege Vulnerability -
CVE-2026-78452
Microsoft Windows SCSI Class System File Information Disclos -
CVE-2026-78451
Microsoft Windows SCSI Class System File Elevation of Privil -
CVE-2026-78450
Windows Reliable Multicast Transport Driver (RMCAST) Remote
Same vendor: Microsoft
-
CVE-2026-96207
Microsoft Partner Center Elevation of Privilege Vulnerabilit -
CVE-2026-94510
Microsoft Bookings Elevation of Privilege Vulnerability -
CVE-2026-83947
Azure Event Grid Spoofing Vulnerability -
CVE-2026-88131
Microsoft Dataverse Remote Code Execution Vulnerability -
CVE-2026-83943
Azure API Center Information Disclosure Vulnerability
Same weakness: CWE-347
-
CVE-2026-108699
hyper-mcp through 0.8.3 Improper Signature Verification of O -
CVE-2026-106581
Docker Desktop for Windows installer failed to verify extern -
CVE-2026-86405
Payment Validation Bypass in Sipay Electronic Money's SanalP -
CVE-2026-85531
Payment Validation Bypass in Sipay Electronic Money's OpenCa -
CVE-2026-107724
fast-jwt treats raw public JWK JSON as an HMAC secret, enabl
V. Comments for CVE-2013-3900
Anonymous User
2026-02-10 07:48:12Эта информационная заметка содержит увлекательные сведения, которые могут вас удивить! Мы собрали интересные факты, которые сделают вашу жизнь ярче и полнее. Узнайте нечто новое о привычных аспектах повседневности и откройте для себя удивительный мир информации. Получить дополнительные сведения - https://vivod-iz-zapoya-2.ru/
Anonymous User
2026-06-20 07:25:191
Anonymous User
2026-06-20 07:30:401
Anonymous User
2026-06-20 09:19:141
Anonymous User
2026-07-02 23:27:361