How to Fix CVE-2012-0151: Improper Input Validation in Windows

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

Patch immediately. CISA's Known Exploited Vulnerabilities catalog lists this CVE, which means active exploitation has been confirmed. CISA KEV entry added 2022-06-08, federal due date 2022-06-22.

What is CVE-2012-0151?

CVE-2012-0151 is the WinVerifyTrust Signature Validation Vulnerability in Microsoft Windows. The flaw lives in the Authenticode signature verification path that Windows uses to decide whether a signed portable executable (PE) file is trustworthy. When Windows checks an Authenticode signature, it is supposed to hash the real contents of the PE and compare that digest against the digest recorded in the signature. On the affected builds it does not validate that digest correctly: an attacker can append extra data to an already-signed, legitimately-trusted executable without breaking the signature check. Windows still reports the tampered file as validly signed.

That is why this is classed as CWE-20, Improper Input Validation. The signature-verification routine accepts a malformed input (a PE padded with attacker-controlled content) that it should have rejected. Because the file keeps a "good" signature, a target who trusts signed binaries, or software that only runs signed code, is tricked into executing the attacker's payload. The result is user-assisted remote code execution: the victim has to open or run the modified file, but once they do, arbitrary code runs in their security context. The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (base score 7.8, High) captures exactly this shape: no privileges needed, but user interaction is required, and the impact to confidentiality, integrity, and availability is total once the file runs.

The affected systems are Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 / R2 / R2 SP1, Windows 7 Gold and SP1, and the Windows 8 Consumer Preview. This is purely a Windows operating-system defect in WinVerifyTrust and the crypto libraries behind it; it is not a Linux package, a network service, or an application bug.

Why this CVE matters

Signature validation is a trust anchor. Antivirus allow-lists, software-restriction and AppLocker publisher rules, driver loading, and plain user judgement ("it's signed by a vendor I recognise, so it's safe") all lean on Authenticode being correct. CVE-2012-0151 breaks that anchor: a malicious payload can ride inside a file that still shows a valid digital signature from a trusted publisher, defeating the exact control that was supposed to catch it.

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2022-06-08, which only happens after exploitation is confirmed in the wild. The same WinVerifyTrust weakness was later abused at scale by malware families that re-signed trojanised installers to slip past trust checks. If you still operate any of the affected legacy Windows builds, treat any window of unpatched exposure as a real risk that signed-binary defenses on those hosts cannot be trusted.

Am I affected?

You are affected if the host runs one of the listed Windows versions and is missing the MS12-024 update. Check whether the patch is present rather than guessing from the OS build alone. Run this in an elevated PowerShell or command prompt on the Windows machine:

# Is the MS12-024 fix (KB2653956) installed on this host?
Get-HotFix -Id KB2653956 -ErrorAction SilentlyContinue

# Windows 8 Consumer Preview shipped a separate update:
Get-HotFix -Id KB2654428 -ErrorAction SilentlyContinue

# wmic equivalent on older builds (XP / 2003 / Vista) that lack Get-HotFix:
wmic qfe get HotFixID,InstalledOn | findstr /i "KB2653956 KB2654428"

If neither command returns a row, the update is not installed and the WinVerifyTrust flaw is unpatched on that machine. Note that WinVerifyTrust lives in the OS, so a missing patch affects every signed file the host validates, not one specific application.

How to fix CVE-2012-0151

The fix is Microsoft security bulletin MS12-024, released on 10 April 2012, which corrects how Windows validates the Authenticode signature of a PE file. The relevant update is KB2653956 for the supported Windows versions, and KB2654428 for the Windows 8 Consumer Preview. Apply the update that matches the host, then reboot. Because every affected OS in the list except Windows 8 Consumer Preview is now out of support, the practical path for many of these machines is to migrate to a supported Windows release that already contains this fix.

Option A: Windows Update (preferred)

If the machine can still reach Windows Update or your WSUS server, the MS12-024 update is delivered there. Run Windows Update and install the security update for your platform, then reboot. After the reboot, confirm KB2653956 (or KB2654428 on the Windows 8 Consumer Preview) shows up under installed updates.

Option B: Offline install from the Microsoft Update Catalog

For isolated or legacy hosts that no longer sync with Windows Update, download the correct MS12-024 package for the exact OS and architecture from the Microsoft Update Catalog, copy it to the machine, and install it with the Windows Update Standalone Installer. Pick the .msu built for that specific Windows version, do not substitute a package built for a different release.

# Run elevated. Replace the filename with the exact MS12-024 .msu you downloaded
# for THIS host's OS and architecture from the Microsoft Update Catalog.
wusa.exe C:\Patches\windows6.1-kb2653956-x64.msu /quiet /norestart

# Reboot to load the corrected WinVerifyTrust / crypto libraries.
shutdown /r /t 60

The signature-verification code is loaded by core OS libraries, so a reboot is required for the corrected code to take effect across the system.

If you can't patch immediately

There is no network filter that fixes this. The vulnerability triggers when a user opens a tampered signed file locally (attack vector LOCAL, user interaction REQUIRED), so a firewall or WAF rule cannot reach the bug. Until MS12-024 is installed, reduce the chance that a forged-but-signed file gets run:

• Do not rely on "the file is digitally signed" as a trust signal on unpatched hosts. Verify file hashes against the publisher's published values instead of trusting the Authenticode badge.
• Restrict execution to a vetted allow-list using AppLocker or Software Restriction Policies keyed on file hash rather than publisher signature, since publisher rules are exactly what this CVE undermines.
• Block delivery of executable attachments and downloads at the mail gateway and proxy so a tampered signed binary is less likely to reach a user in the first place.
• Prioritise getting the affected legacy hosts off the network or migrated to a supported, already-patched Windows release.

These steps lower risk; only MS12-024 removes the flaw.

How to verify the fix worked

After installing the update and rebooting, confirm the KB is present on the host:

# Confirm the MS12-024 update is installed
Get-HotFix -Id KB2653956            # supported Windows builds
Get-HotFix -Id KB2654428            # Windows 8 Consumer Preview only

# Legacy builds without Get-HotFix:
wmic qfe get HotFixID,InstalledOn | findstr /i "KB2653956 KB2654428"

Then run an authenticated vulnerability scan with a current signature set and confirm the scanner no longer flags CVE-2012-0151 on the host. If the machine was internet-facing or used to run untrusted signed binaries while unpatched, review it for unexpected scheduled tasks, services, and outbound connections, and rotate any credentials that processes on that host could have read, since a successful exploit runs code in the user's context.

Frequently asked questions

Which update fixes CVE-2012-0151?

Microsoft security bulletin MS12-024, released 10 April 2012. The update is KB2653956 for the supported affected Windows versions and KB2654428 for the Windows 8 Consumer Preview. Install the one matching your OS, then reboot.

Can an attacker exploit this remotely without any user action?

No. The CVSS vector is AV:L / UI:R, meaning local attack vector with required user interaction. A victim has to open or run the tampered, still-validly-signed file. Once they do, arbitrary code runs in their security context, which is why it is rated High (7.8).

My Windows 7 and Server 2003 boxes are end of life. Do I still need MS12-024?

If those hosts are still running, yes, the flaw is present and CISA lists it as actively exploited. KB2653956 applies to Windows 7 and Server 2003 SP2 among others. The better long-term answer is to migrate off these unsupported builds onto a current Windows release that already includes the fix.

Will blocking ports or adding a WAF rule mitigate it?

No. The vulnerability is triggered locally when a forged signed file is opened, so network-layer filtering never reaches it. Allow-listing executables by file hash and installing MS12-024 are the controls that actually help.

References

• Official vendor advisory: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-024
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2012-0151
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV record: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0151
• Additional reference: http://www.securitytracker.com/id?1026906
• Additional reference: http://osvdb.org/81135
• Additional reference: http://www.us-cert.gov/cas/techalerts/TA12-101A.html
• Additional reference: http://secunia.com/advisories/48581

This guide was assembled from the official vendor advisory, the NVD record, and the CISA KEV catalog entry on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Nearby vulnerabilities you may as well remediate alongside this fix:

• How to Fix CVE-2012-4969: Use After Free in Internet Explorer
• How to Fix CVE-2012-2539: Out-of-Bounds Write in Microsoft Word
• How to Fix CVE-2012-1856: Security vulnerability in Microsoft Office
• How to Fix CVE-2012-1889: Out-of-bounds Write in Xml Core Services
• How to Fix CVE-2012-4792: Use-After-Free in Internet Explorer