CVE-2020-1464

What is Windows Authenticode File Signing?

Authenticode is Microsoft's code-signing scheme, used to cryptographically verify that a file (an executable, driver, or installer) hasn't been tampered with since it was signed by a trusted publisher. Windows and security software rely heavily on Authenticode validation to decide whether to trust a file — which is exactly what this vulnerability undermines.

Overview

CVE-2020-1464, nicknamed "GlueBall" by the security research community, is a spoofing vulnerability (CWE-347, improper verification of cryptographic signature) in how Windows validates file signatures. The flaw allows an attacker to append additional content to an already-signed file — for instance, appending a malicious payload to a legitimately-signed installer — without invalidating the file's Authenticode signature, letting Windows and signature-checking security tools treat the tampered file as still trustworthy (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High). Public reporting at the time of the August 2020 patch indicated the technique had been abused by malware distributors for several years prior — one of the more striking examples in this era of a signature-validation weakness being actively exploited in the wild long before a fix existed.

Technical Details

The vulnerability exploits how Windows' Authenticode signature verification parses a signed file: it validates the portion of the file it expects to be signed, but doesn't adequately account for additional data appended after that signed region. An attacker can append arbitrary content — including a second, malicious payload — to a legitimately signed file, and the signature check still passes, since it only examines the originally-signed bytes.

Discovery

Publicly tracked via Microsoft's advisory; security researchers and journalists reported around the time of the patch that the technique had reportedly been used by malware operators for signature-bypass purposes for a number of years prior to the 2020 fix.

Exploitation Context

CISA added this CVE to KEV in November 2021 based on confirmed exploitation. Because the underlying technique had allegedly been used by malware distributors for years before Microsoft patched it, this vulnerability illustrates a case where "actively exploited" long predates "publicly known" — a reminder that a lack of public disclosure doesn't mean a technique isn't already being used against real victims.

Remediation

1. Apply Microsoft's August 2020 Patch Tuesday update immediately if not already installed.
2. Don't rely solely on Authenticode signature validity as a trust signal for file legitimacy — combine it with reputation-based and behavioral detection in your endpoint security stack.
3. Review historical detections of "signed" malware in your environment predating August 2020, since this bypass technique may explain how some previously-signed-looking malicious files evaded signature-based trust checks.
4. Treat this CVE as a reminder to patch proactively rather than assuming a lack of public exploitation reporting means a vulnerability isn't already being abused.