Read the docs
TI-2023-20903 Aliases CVE-2023-40012

uthenticode EKU validation bypass

Priority LOW 32CWE-325Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-347.

Summary

uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures. Versions of uthenticode prior to the 2.x series did not check Extended Key Usages in certificates, in violation of the Authenticode X.509 certificate profile. As a result, a malicious user could produce a "signed" PE file that uthenticode would verify and consider valid using an X.509 certificate that isn't entitled to produce code signatures (e.g., a SSL certificate). By design, uthenticode does not perform full-chain validation. However, the absence of EKU validation was an unintended oversight. The 2.0.0 release series includes EKU checks. There are no workarounds to this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00247 16th percentileScored 2026-11-07
Fix Fixed uthenticode (trailofbits): 2.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
trailofbitsuthenticodebefore 2.0.02.0.0Patch availableCNA
  • uthenticode Vendortrailofbits Affected before 2.0.0 Fixed in 2.0.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:trailofbits:uthenticode:*:*:*:*:*:*:*:*before 2.0.0Vulnerabletrailofbits
  • cpe:2.3:a:trailofbits:uthenticode:*:*:*:*:*:*:*:* Versions before 2.0.0 Vulnerable ·trailofbits

Remediation

  • Fix · CNA uthenticode (trailofbits) Fixed in 2.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-40012

References

Patch 2

Advisory 1

  • TI-2023-20862 uthenticode signature validation bypass vulnerability CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences