Operation Dust Storm
…malicious Windows Help (.hlp) file, which exploited CVE- 2010-1885.
CVE-2010-1885 Public exploit EPSS 71.1%
The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows…
Summary
A vulnerability in Microsoft Windows Help and Support Center on Windows XP and Windows Server 2003 allows remote attackers to bypass the trusted documents whitelist and execute arbitrary commands via a crafted hcp:// URL. Windows XP and Windows Server 2003 users are affected.
Official description · CVE.org
The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle malformed escape sequences, which allows remote attackers to bypass the trusted documents whitelist (fromHCP option) and execute arbitrary commands via a crafted hcp:// URL, aka "Help Center URL Validation Vulnerability."
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
65.5 / 100
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 1
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 13 months after disclosure. Public exploit code (Metasploit) was available 5 days before disclosure.
- Public exploit codeMetasploit5 days before
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+13 mo
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo high- or medium-confidence techniques. The 3 available links are lower confidence and listed below.
Lower-confidence links (3)
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
- Drive-by CompromiseT1189 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
- Exploitation for Client ExecutionT1203 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
- Malicious FileT1204.002 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
What security researchers reported
Named in 1 threat report1 reports7d2.scene7.com
Reports are matched by finding the exact id CVE-2010-1885 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Also mentioned in 5 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- 2016: Malware Analysis Report1 May 2026
- APT291 May 2026
- VirusTotal report for Bang Bang#2.xls14 Mar 2026
- CVE Data16 Feb 2026
- CVE -CVE Reference Map for Source MS - Curios RE active candidates CVE version 2006110131 Jan 2025