CVE-2013-3900
5.5, medium Known exploitedMicrosoft WinVerifyTrust function Remote Code Execution
- CVSS
- 5.5, medium medium CVSS v3.1
- EPSS, next 30 days
- 45% higher than 98.7% of scored CVEs
- Exploitation
- Confirmed in the wild
- Published
- 11 Dec 201312 years ago
Known exploited
CISA added this to the Known Exploited Vulnerabilities Catalog on 10 Jan 2022. US federal agencies had to remediate by 10 Jul 2022, a deadline that has passed.
Required action. Apply updates per vendor instructions.
Description
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11. While the format is different from the original CVE published in 2013, except for clarifications about how to configure the EnableCertPaddingCheck registry value, the information herein remains unchanged from the original text published on December 10, 2013, Microsoft does not plan to enforce the stricter verification behavior as a default functionality on supported releases of Microsoft Windows. This behavior remains available as an opt-in feature via reg key setting, and is available on supported editions of Windows released since December 10, 2013. This includes all currently supported versions of Windows 10 and Windows 11. The supporting code for this reg key was incorporated at the time of release for Windows 10 and Windows 11, so no security update is required; however, the reg key must be set. See the Security Updates table for the list of affected software. Vulnerability Description A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for portable executable (PE) files. An anonymous attacker could exploit the vulnerability by modifying an existing signed executable file to leverage unverified portions of the file in such a way as to add malicious code to the file without invalidating the signature. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Exploitation of this vulnerability requires that a user or application run or install a specially crafted, signed PE file. An attacker could modify an... See more at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900
Details
- Vendor
- Microsoft
- Product
- Windows 10 Version 1809
- Weakness
- CWE-347 (opens in a new tab)
- Status
- Analyzed
- Updated
- 7 Oct 2026
- Assigner
- secure@microsoft.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References 4
Patches and fixes 1
Advisories 2
The kind is read from NVD's tags where present and from the shape of the URL otherwise, so treat it as a hint.
Other Microsoft CVEs
Every Microsoft CVE we holdSame vendor in what we hold, not a known link between the flaws.
- CVE-2026-96951 Microsoft Windows Command Injection Vulnerability KEV EPSS 2% 8.8, high
- CVE-2026-81963 Microsoft Windows Link Following Vulnerability KEV EPSS 0.4% 7.8, high
- CVE-2026-85880 Microsoft Windows Heap-Based Buffer Overflow Vulnerability KEV EPSS 4% 7.8, high
- CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerability KEV EPSS 2% 8.8, high
- CVE-2026-68820 Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability KEV EPSS 0.3% 7, high
- CVE-2026-50522 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability KEV EPSS 3% 9.8, critical
- CVE-2026-56155 Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability KEV EPSS 0.3% 7.8, high
- CVE-2026-56164 Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability KEV EPSS 1% 9.8, critical
Beyond this page
Is CVE-2013-3900 in your network?
This page tells you how dangerous CVE-2013-3900 is out there. Whether it sits on one of your devices, only a scan of your own network can tell. That is what our systems do, every day, for the companies we protect.
CVE-2013-3900 is in the CISA catalogue of exploited vulnerabilities: attackers are already exploiting it.
-
EXYS7600 OCELOT
Find it before attackers do
Ocelot scans your network on a schedule and reports every vulnerability it finds by its CVE identifier, with its CVSS score and how many of your hosts are affected. A finding like CVE-2013-3900 comes with the devices to patch.
Learn more about EXYS7600 OCELOT -
EXYS7950 KONDRA
Detect it if it's exploited
Until the patch is applied, Kondra monitors your network, events and endpoints in real time. It keeps an inventory of the software installed on every endpoint, and its anomaly detection rules flag what an attacker does once inside.
Learn more about EXYS7950 KONDRA
Assembled from the NVD 2.0 API, the CISA Known Exploited Vulnerabilities Catalog and FIRST EPSS. Scores are as of our last collection on 17 Oct 2026, not the live upstream state.