{"id":"CVE-2010-2568","published":"2010-07-22T05:43:49Z","modified":"2026-06-16T23:20:59Z","title":"Microsoft Windows Remote Code Execution Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an improper input validation issue in the Windows Shell component of Microsoft Windows, affecting XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7, where crafted .LNK or .PIF shortcut files are not handled correctly during icon display in Windows Explorer.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:53:54Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.89623,"percentile":0.99787,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-09-15","dueDate":"2022-10-06","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046; https://nvd.nist.gov/vuln/detail/CVE-2010-2568","provenance":"source"},"vulncheckKev":{"dateAdded":"2010-10-01","exploitedFirstSeen":"2010-10-01","ransomware":false,"evidence":[{"url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/web-attack/54/stuxnet-malware-targets-scada-systems","date":"2010-10-01"},{"url":"https://securelist.com/cybercrime-raiders/36323/","date":"2010-10-12"},{"url":"https://users.ece.cmu.edu/~tdumitra/public_documents/bilge12_zero_day.pdf","date":"2012-10-18"},{"url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf","date":"2015-02-01"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2020-0603.pdf","date":"2020-06-03"},{"url":"https://dl.acm.org/doi/pdf/10.1145/3465481.3465758","date":"2021-08-17"},{"url":"https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf","date":"2021-12-15"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-09-15"},{"url":"https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_Equation_Group_866e8d2944.pdf","date":"2022-11-15"},{"url":"https://www.kaspersky.co.uk/about/press-releases/old-microsoft-office-vulnerability-exploited-six-times-more-in-q2","date":"2023-07-19"}],"evidenceTotal":15,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"http://isc.sans.edu/diary.html?storyid=9181","tags":["Exploit","Issue Tracking"]},{"url":"http://isc.sans.edu/diary.html?storyid=9190","tags":["Issue Tracking"]},{"url":"http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/","tags":["Press/Media Coverage"]},{"url":"http://secunia.com/advisories/40647","tags":["Vendor Advisory"]},{"url":"http://securitytracker.com/id?1024216","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.f-secure.com/weblog/archives/00001986.html","tags":["Not Applicable"]},{"url":"http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf","tags":["Exploit"]},{"url":"http://www.kb.cert.org/vuls/id/940193","tags":["Patch","Third Party Advisory","US Government Resource"]},{"url":"http://www.microsoft.com/technet/security/advisory/2286198.mspx","tags":["Broken Link","Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/41732","tags":["Broken Link","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA10-222A.html","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046","tags":["Patch","Vendor Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11564","tags":["Broken Link"]},{"url":"https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm","tags":["Third Party Advisory"]},{"url":"http://isc.sans.edu/diary.html?storyid=9181","tags":["Exploit","Issue Tracking"]},{"url":"http://isc.sans.edu/diary.html?storyid=9190","tags":["Issue Tracking"]},{"url":"http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/","tags":["Press/Media Coverage"]},{"url":"http://secunia.com/advisories/40647","tags":["Vendor Advisory"]},{"url":"http://securitytracker.com/id?1024216","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.f-secure.com/weblog/archives/00001986.html","tags":["Not Applicable"]},{"url":"http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf","tags":["Exploit"]},{"url":"http://www.kb.cert.org/vuls/id/940193","tags":["Patch","Third Party Advisory","US Government Resource"]},{"url":"http://www.microsoft.com/technet/security/advisory/2286198.mspx","tags":["Broken Link","Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/41732","tags":["Broken Link","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA10-222A.html","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046","tags":["Patch","Vendor Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11564","tags":["Broken Link"]},{"url":"https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2568","tags":["US Government Resource"]}],"techniques":[{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1204.001","name":"Malicious Link","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: user opens malicious shortcut file","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"via a crafted (1) .LNK or (2) .PIF shortcut file","start":182,"end":230}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary code execution from shortcut","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows local users or remote attackers to execute arbitrary code","start":117,"end":181}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-93c55e10ab45afc37c85","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf","date":null,"mentions":[{"quote":"For example, the CVE-2010-2568 CplLnk vulnerability has never affected","start":90724,"end":90794},{"quote":"detected and blocked by Microsoft real-time\r\nantimalware products in 1H16, shaded according to relative prevalence\r\nExploit Type 3Q15 4Q15 1Q16 2Q16\r\nJS/Axpergle Exploit kit 0.71% 0.92% 0.53% 0.40%\r\nSWF/Netis Adobe Flash Player 0.00% 0.00% 0.27% 0.00%\r\nCVE-2010-2568 (CplLnk) Operating system 0.18% 0.24% 0.13%","start":94557,"end":94867},{"quote":" CVE-2010-2568 is a vulnerability in Windows Shell.","start":95764,"end":95816},{"quote":"CVE-2010-2568 by creating a malformed shortcut file—typically","start":96011,"end":96072},{"quote":"Windows have never been vulnerable to exploits of CVE-2010-2568.","start":96661,"end":96725}]},{"id":"SRC-6455ab6c9917b3700d6d","title":"Version: 1.5","publisher":"media.kasperskycontenthub.com","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf","date":null,"mentions":[{"quote":"(CVE-2010-2568).","start":14557,"end":14573}]},{"id":"SRC-619721166ae9d9d7fdcd","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf","date":null,"mentions":[{"quote":"For example, the CVE-2010-2568 CplLnk","start":70216,"end":70253},{"quote":"CVE-2010-2568 (CplLnk) Operating system 0.35% 0.35% 0.30% 0.23%","start":75048,"end":75111},{"quote":" CVE-2010-2568, the most commonly targeted individual vulnerability in","start":76224,"end":76295},{"quote":"An attacker exploits CVE-2010-\r\n2568 by creating a malformed shortcut file—typically distributed through","start":76500,"end":76604},{"quote":"exploits of CVE-2010-2568.","start":77215,"end":77241}]},{"id":"SRC-141f416f8e71537fc9f7","title":"Security Response","publisher":"docs.broadcom.com","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en","date":null,"mentions":[{"quote":"LNK Vulnerability (CVE-2010-2568)","start":63872,"end":63905}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2010-2572","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-2572","exploited":true,"exploitedSince":"2022-09-15","provenance":"source"},"exploits":[{"id":14403,"url":"https://www.exploit-db.com/exploits/14403","title":"Microsoft Windows - Automatic .LNK Shortcut File Code Execution","type":"local","platform":"windows","date":"2010-07-18","verified":true,"provenance":"source"},{"id":16574,"url":"https://www.exploit-db.com/exploits/16574","title":"Microsoft Windows - Shell LNK Code Execution (MS10-046) (Metasploit)","type":"remote","platform":"windows","date":"2010-09-21","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2010-07-18"},"metasploit":[{"name":"Microsoft Windows Shell LNK Code Execution","module":"exploit/windows/browser/ms10_046_shortcut_icon_dllloader","type":"exploit","disclosureDate":"2010-07-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms10_046_shortcut_icon_dllloader.rb"},{"name":"Microsoft Windows Shell LNK Code Execution","module":"exploit/windows/smb/ms10_046_shortcut_icon_dllloader","type":"exploit","disclosureDate":"2010-07-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/ms10_046_shortcut_icon_dllloader.rb"},{"name":"FannyBMP or DementiaWheel Detection Registry Check","module":"post/windows/gather/forensics/fanny_bmp_check","type":"post","disclosureDate":null,"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/forensics/fanny_bmp_check.rb"}],"first":{"date":"2010-07-16","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms10_046_shortcut_icon_dllloader.rb"},"provenance":"source"},"exploitRefs":["http://isc.sans.edu/diary.html?storyid=9181","http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf","http://www.securityfocus.com/bid/41732"],"flow":[{"stage":"exploitation","techniques":["T1204.001"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2010-07-16","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2010-07-18","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms10_046_shortcut_icon_dllloader.rb","provenance":"source"},{"date":"2010-07-22","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2568","provenance":"source"},{"date":"2010-10-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/web-attack/54/stuxnet-malware-targets-scada-systems","provenance":"source"},{"date":"2022-09-15","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-09-15","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-2572","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":4438},"priority":{"score":77.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 5874 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9979"},{"name":"Named in threat reports","points":8.98,"detail":"4 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 2 Exploit-DB entries; 3 Metasploit modules"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-20"}}