{"id":"CVE-2020-1464","kind":"vulnerability","aliases":["CVE-2020-1464"],"related":[],"title":"Microsoft Windows: Microsoft Windows Spoofing Vulnerability","description":"A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass security features and load improperly signed files.\nIn an attack scenario, an attacker could bypass security features intended to prevent improperly signed files from being loaded.\nThe update addresses the vulnerability by correcting how Windows validates file signatures.","summary":"Windows incorrectly validates file signatures, so a crafted file can pass as properly signed and load. An attacker can bypass security features and get unsigned or improperly signed code to run.","severity":"high","cvss":7.8,"epss":0.38946,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","windows"],"not_affected_if":["unknown"],"how_to_check":"Confirm the Windows build is patched for CVE-2020-1464 via Windows Update history or Get-HotFix; the sources do not name the KB numbers.","fix":"Apply the Microsoft update for CVE-2020-1464 per vendor instructions (CISA required action); the sources do not name the exact KB or build.","status":"open","published_at":"2020-08-17T19:15:14+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:37:31+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:37:31Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft update for CVE-2020-1464 per vendor instructions (CISA required action); the sources do not name the exact KB or build.","reach":"unknown","impact":"high","summary":"Windows incorrectly validates file signatures, so a crafted file can pass as properly signed and load. An attacker can bypass security features and get unsigned or improperly signed code to run.","category":"infrastructure","who_cares":["windows"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Improperly signed code loads and security features are bypassed on Windows","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2020-1464 for affected builds, KB numbers and the exact attack vector; sources give none.","how_to_check":"Confirm the Windows build is patched for CVE-2020-1464 via Windows Update history or Get-HotFix; the sources do not name the KB numbers.\nunknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000478,"input_tokens":2833,"output_tokens":389,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1464':9A,12A '-2020':8A,11A 'address':96C 'attack':35B,60C,77C,80C 'bypass':37B,67C,82C 'code':46B 'correct':100C 'could':66C,81C 'craft':25B 'cve':7A,10A 'exist':52C 'exploit':15B,63C 'featur':39B,69C,84C 'file':21B,26B,57C,74C,90C,104C 'get':41B 'improp':44B,72C,88C 'incorrect':19B,55C 'infrastructur':16B 'intend':85C 'load':33B,71C,93C 'microsoft':1A,3A,13A 'pass':28B 'prevent':87C 'proper':30B 'run':48B 'scenario':78C 'secur':38B,68C,83C 'sign':31B,45B,73C,89C 'signatur':22B,58C,105C 'spoof':5A,50C 'success':62C 'unsign':42B 'updat':95C 'valid':20B,56C,103C 'vulner':6A,51C,65C,98C 'window':2A,4A,17B,18B,54C,102C 'windows':14A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-08-17T19:15:14+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-1464","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-1464","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T20:35:38+00:00","note":null},{"source":"epss","external_id":"CVE-2020-1464","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-1464","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-1464","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1464","severity":null,"published_at":"2020-08-17T19:15:14+00:00","modified_at":"2026-06-17T03:01:28+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}