CVE-2026-55144
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform tampering locally.
Risk Assessment
The risk involves potential compromise of cryptographic data integrity by an authorized user, which could lead to unauthorized system modifications.
Recommendation
It is recommended to immediately apply the security update from Microsoft for Windows CryptoAPI and monitor systems for unauthorized changes.
Other vulnerabilities in Windows CryptoAPI
See all- CVE-2020-0601HighActively exploited
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source.
- CVE-2023-35339High
A vulnerability in Windows CryptoAPI allows for a Denial of Service (DoS) attack, potentially leading to service unavailability. An attacker can exploit this flaw to disrupt system operations.
Original NVD description (English source)
Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform tampering locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS