So just an Authenticode bypass? Meh. As @taviso said, nothing like an RCE in PE parsing, not even sure what the NSA would do with this.
It might be a fun crypto vuln though!
-
So doesn’t make sense why it’s rated important and not critical. Unless client cert authentication isn’t affected.
I wouldn't rely much on any particular vulnerability importance scoring system in the wild these days. For starters, they're often limited to scoring a vulnerability alone in a vacuum, as opposed to how it's likely to be used with its friends in the real world.
