CVE-2010-0486: Input Validation
The WinVerifyTrust function in Authenticode Signature Verification 5.1, 6.0, and 6.1 in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly use unspecified fields in a file digest, which allows user-assisted remote attackers to execute arbitrary code via a modified (1) Portable Executable (PE) or (2) cabinet (aka .CAB) file that incorrectly appears to have a valid signature, aka "WinVerifyTrust Signature Validation Vulnerability."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0486?
CVE-2010-0486 has been rated as critical due to potential exploitation leading to remote code execution.
How do I fix CVE-2010-0486?
To mitigate CVE-2010-0486, apply the latest security updates released by Microsoft for affected Windows versions.
Which Microsoft operating systems are affected by CVE-2010-0486?
CVE-2010-0486 affects multiple Microsoft operating systems including Windows 2000, Windows XP, Windows Vista, and various versions of Windows Server 2003 and 2008.
What type of vulnerability is CVE-2010-0486?
CVE-2010-0486 is a vulnerability in the WinVerifyTrust function related to the Authenticode signature verification process.
Can CVE-2010-0486 be exploited remotely?
Yes, CVE-2010-0486 can be exploited remotely if an attacker tricks a user into executing malicious software.