{
  "id": "CVE-2020-1464",
  "url": "https://spydr.io/cve/CVE-2020-1464",
  "published": "2020-08-17T19:15:14.867Z",
  "modified": "2026-06-17T03:01:28.433Z",
  "score": 7.8,
  "severity": "high",
  "cvss_version": "3.1",
  "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "score_source": "microsoft.com",
  "epss": 0.38946,
  "epss_percentile": 0.98556,
  "exploited": true,
  "kev": {
    "added": "2021-11-03",
    "due": "2022-05-03",
    "action": "Apply updates per vendor instructions.",
    "ransomware": "Unknown",
    "name": "Microsoft Windows Spoofing Vulnerability",
    "notes": "https://nvd.nist.gov/vuln/detail/CVE-2020-1464"
  },
  "ssvc_exploitation": "active",
  "vendors": [
    "Microsoft"
  ],
  "products": [
    "Microsoft Windows 10 Version 1803",
    "Microsoft Windows 10 Version 1809",
    "Microsoft Windows Server 2019",
    "Microsoft Windows Server 2019 (Server Core installation)",
    "Microsoft Windows 10 Version 1909",
    "Microsoft Windows Server, version 1909 (Server Core installation)",
    "Microsoft Windows 10 Version 1709 for 32-bit Systems",
    "Microsoft Windows 10 Version 1709",
    "Microsoft Windows 10 Version 1903 for 32-bit Systems",
    "Microsoft Windows 10 Version 1903 for x64-based Systems",
    "Microsoft Windows 10 Version 1903 for ARM64-based Systems",
    "Microsoft Windows Server, version 1903 (Server Core installation)",
    "Microsoft Windows 10 Version 2004",
    "Microsoft Windows Server version 2004",
    "Microsoft Windows 10 Version 1507",
    "Microsoft Windows 10 Version 1607",
    "Microsoft Windows Server 2016",
    "Microsoft Windows Server 2016 (Server Core installation)",
    "Microsoft Windows 7",
    "Microsoft Windows 7 Service Pack 1"
  ],
  "cwes": [
    "CWE-347"
  ],
  "description": "A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass security features and load improperly signed files. In an attack scenario, an attacker could bypass security features intended to prevent improperly signed files from being loaded. The update addresses the vulnerability by correcting how Windows validates file signatures.",
  "status": "Analyzed",
  "score_type": "Secondary",
  "scores": {
    "cvss_v40": null,
    "cvss_v31": 7.8,
    "cvss_v30": null
  },
  "references": [
    {
      "url": "https://blog.virustotal.com/2019/01/distribution-of-malicious-jar-appended.html",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://krebsonsecurity.com/2020/08/microsoft-put-off-fixing-zero-day-for-2-years/",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://medium.com/%40TalBeerySec/glueball-the-story-of-cve-2020-1464-50091a1f98bd",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1464",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1464",
      "tags": [
        "US Government Resource"
      ]
    }
  ],
  "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1464",
  "covered_in": [],
  "attribution": [
    {
      "source": "NVD",
      "url": "https://nvd.nist.gov",
      "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD."
    },
    {
      "source": "CISA KEV",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "notice": "Known exploited vulnerabilities from the CISA KEV catalog."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss",
      "notice": "Exploit prediction scores from FIRST EPSS."
    }
  ]
}