CVE-2013-3900
Microsoft WinVerifyTrust function Remote Code Execution
Description
CVE-2013-3900 is a medium-severity improper verification of cryptographic signature vulnerability in the Microsoft WinVerifyTrust function. This flaw exists in the way WinVerifyTrust handles Windows Authenticode signature verification for portable executable (PE) files. An attacker can modify an existing signed executable to inject malicious code into unverified portions of the file without invalidating the digital signature. Successful exploitation of CVE-2013-3900 could allow an attacker to take complete control of an affected system, installing programs, modifying data, or creating new accounts with full user rights. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 80.49% (99.1st percentile), the likelihood of exploitation remains very high despite the vulnerability originating from 2013.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1607 | - |
| microsoft | windows 10 1809 | - |
| microsoft | windows 10 1909 | - |
| microsoft | windows 10 20h2 | - |
| microsoft | windows 10 21h1 | - |
| microsoft | windows 10 21h2 | - |
| microsoft | windows 10 22h2 | - |
| microsoft | windows 11 21h2 | - |
| microsoft | windows 11 22h2 | - |
| microsoft | windows 11 23h2 | - |
| microsoft | windows 11 24h2 | - |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
| microsoft | windows server 2019 | - |
| microsoft | windows server 2022 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900(Patch, Vendor Advisory)
- http://blogs.technet.com/b/srd/archive/2013/12/10/ms13-098-update-to-enhance-the-security-of-authenticode.aspx(Broken Link)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-098(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3900(US Government Resource)
Weakness Type
CWE-347: Improper Verification of Cryptographic Signature
CVE-2013-3900 arises from improper verification of cryptographic signatures in the WinVerifyTrust function. The Windows Authenticode signature validation process does not account for all portions of a PE file, allowing attackers to append malicious content to signed executables without invalidating the original signature. This means files that appear legitimately signed can actually contain injected malicious code in unverified regions of the binary.
Learn more: CWE-347 — Improper Verification of Cryptographic Signature
Impact Analysis
CVE-2013-3900 carries a CVSS 3.1 score of 5.5 (MEDIUM) based on the vendor assessment, reflecting a locally exploitable vulnerability that requires user interaction. The attack complexity is low, meaning no special conditions are needed beyond convincing a user to run or install a manipulated signed PE file. While no authentication is required, user interaction is necessary as the victim must execute the tampered file. Integrity (High): The primary impact is on data integrity, as attackers can inject unauthorized code into trusted signed executables without detection. Although the CVSS score appears moderate, the real-world impact is significant because this vulnerability fundamentally undermines the trust model of Authenticode code signing across the entire Windows ecosystem. With an EPSS score of 80.49%, active exploitation is near-certain, and organizations relying on signature-based trust for software distribution face substantial risk if the EnableCertPaddingCheck registry setting is not configured.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2013-3900 in the wild by including it in the Known Exploited Vulnerabilities catalog. The EPSS score of 80.49% (99.1st percentile) indicates near-certain exploitation activity. Despite being published in 2013, this vulnerability remains dangerous because Microsoft chose not to enforce the stricter signature verification behavior as a default, instead making it an opt-in registry setting via EnableCertPaddingCheck. This means many systems remain vulnerable over a decade after the initial disclosure. The vulnerability has been referenced in multiple vendor advisories including MS13-098, and federal agencies were required to remediate by 2022-07-10 per CISA directive.
Remediation
- Enable the stricter verification behavior by configuring the EnableCertPaddingCheck registry value as described in Microsoft Security Bulletin MS13-098. Set the registry key
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config\EnableCertPaddingCheckto1on 32-bit systems, and additionally underHKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config\EnableCertPaddingCheckon 64-bit systems. - Verify that all affected Windows systems (Windows 7, 8.1, 10, 11, Server 2008 through Server 2022) have the registry configuration applied, as Microsoft does not enforce this as a default setting even on current Windows versions.
- Implement application whitelisting and code integrity policies (such as Windows Defender Application Control) to restrict execution of modified binaries, providing defense-in-depth beyond signature verification alone.
- Monitor for indicators of compromise by auditing the execution of PE files with anomalous padding or unexpected content appended after the Authenticode signature, using endpoint detection tools capable of inspecting PE file structures.
- As a long-term hardening measure, implement strict cryptographic signature verification across your software supply chain by validating not only the signature but also the integrity of the entire file structure before trusting signed binaries.
Technical Details
CVE-2013-3900 exploits a fundamental design weakness in the Windows Authenticode signature verification process implemented by the WinVerifyTrust function. When validating PE files, the function verifies the cryptographic signature over specific sections of the file but does not account for content appended beyond the signed data boundaries. This means an attacker can take a legitimately signed PE file and insert arbitrary data, including executable code, into the regions not covered by the signature hash calculation. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects that exploitation requires local access and user interaction, specifically convincing a user to execute the modified file, but once executed, the integrity impact is high because the operating system treats the modified file as validly signed. This vulnerability is particularly insidious because it undermines the Authenticode trust model that enterprises rely on for software deployment, and Microsoft has only provided an opt-in fix rather than a default enforcement, leaving systems that have not explicitly configured the EnableCertPaddingCheck registry value exposed.
Frequently Asked Questions
Is CVE-2013-3900 being actively exploited?
Yes. CVE-2013-3900 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 80.49% (99.1st percentile) indicates a very high probability of exploitation. Despite being over a decade old, the vulnerability remains exploitable on systems that have not configured the opt-in registry fix.
What products are affected by CVE-2013-3900?
CVE-2013-3900 affects virtually all Microsoft Windows versions, including Windows 7, Windows 8.1, Windows 10 (all versions from 1507 through 22H2), Windows 11 (21H2 through 24H2), Windows RT 8.1, and Windows Server 2008 through Server 2022. The vulnerability is present in the WinVerifyTrust function used for Authenticode signature verification.
How do I fix CVE-2013-3900?
The fix requires manually enabling the EnableCertPaddingCheck registry value, as Microsoft does not enforce stricter verification by default. Set the registry key under HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config and, on 64-bit systems, also under the Wow6432Node equivalent. No security update installation is needed for Windows 10 and Windows 11, but the registry key must be configured.
How severe is CVE-2013-3900?
CVE-2013-3900 has a vendor-assigned CVSS 3.1 score of 5.5 (MEDIUM), though NVD has scored it at 8.8 (HIGH) in a secondary assessment. Despite the moderate vendor score, the practical severity is significant because it undermines the entire Windows code signing trust model, and the EPSS score of 80.49% places it in the 99.1st percentile for exploitation likelihood.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.