CVE-2023-35339
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
A vulnerability in Windows CryptoAPI allows for a Denial of Service (DoS) attack, potentially leading to service unavailability. An attacker can exploit this flaw to disrupt system operations.
Risk Assessment
Organizations may experience downtime of critical services, leading to financial and reputational losses. In particular, services relying on Windows CryptoAPI are at risk.
Recommendation
It is recommended to update systems to the latest versions that include security patches. Monitoring logs and implementing additional protections against DoS attacks is also advisable.
Other vulnerabilities in Windows CryptoAPI
See all- CVE-2020-0601HighActively exploited
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source.
- CVE-2026-55144High
Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform tampering locally.
Original NVD description (English source)
Windows CryptoAPI Denial of Service Vulnerability
Vulnerability data from NVD (NIST) · CISA KEV · EPSS