Live › vulnerability › CVE-2010-2568
Go to dashboardWindows parses shortcut (.lnk) files unsafely, so merely displaying the icon of a malicious shortcut can run code. An attacker who gets a user to browse to or open a folder containing such a file runs code as that logged-on user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Microsoft Windows | vendor | – | – |
| microsoft windows 7 | vendor | – | – |
| microsoft windows server 2003 | vendor | – | – |
| microsoft windows server 2008 | vendor | – | – |
| microsoft windows server 2008 | vendor | = r2 | – |
| microsoft windows vista | vendor | – | – |
| microsoft windows xp | vendor | – | – |
Unknown from the sources.
Apply the Microsoft update for CVE-2010-2568 per vendor instructions (CISA required action); the sources do not name the KB or patched build.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.
This page as .md · .json · in your agent: get_signal("CVE-2010-2568")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.