{"id":"CVE-2010-2568","kind":"vulnerability","aliases":["CVE-2010-2568"],"related":[],"title":"Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7…","description":"Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.","summary":"Windows parses shortcut (.lnk) files unsafely, so merely displaying the icon of a malicious shortcut can run code. An attacker who gets a user to browse to or open a folder containing such a file runs code as that logged-on user.","severity":"critical","cvss":9.3,"epss":0.89623,"exploited":true,"exploited_at":"2022-09-15T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 7","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2003","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows vista","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows xp","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","file-shares","infrastructure","removable-media","windows"],"not_affected_if":["non-windows","patched-windows"],"how_to_check":null,"fix":"Apply the Microsoft update for CVE-2010-2568 per vendor instructions (CISA required action); the sources do not name the KB or patched build.","status":"open","published_at":"2010-07-22T05:43:49+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:36+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:10:36Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft update for CVE-2010-2568 per vendor instructions (CISA required action); the sources do not name the KB or patched build.","reach":"local","impact":"high","summary":"Windows parses shortcut (.lnk) files unsafely, so merely displaying the icon of a malicious shortcut can run code. An attacker who gets a user to browse to or open a folder containing such a file runs code as that logged-on user.","category":"infrastructure","who_cares":["windows","file-shares","removable-media"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs arbitrary code as the logged-on user","analyst_note":"Find the Microsoft bulletin (MS10-046) and the KB and affected Windows builds to fill in how_to_check and fix; see the CISA KEV entry for the due date.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-windows","non-windows"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00047,"input_tokens":2861,"output_tokens":368,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2010':24A,27A,173C '-2568':25A,28A '-2772':174C '1':139C '2':142C '2003':9A,37A,112C '2008':16A,41A,45A,119C '2010':164C '7':22A,33A,125C 'allow':126C 'arbitrari':134C 'attack':80B,131C 'brows':86B 'code':78B,97B,135C 'contain':92B 'craft':138C 'cve':23A,26A,172C 'demonstr':158C 'display':69B,153C 'execut':133C 'exploit':52B 'explor':156C 'file':54B,65B,95B,145C 'file-shar':53B 'folder':91B 'get':82B 'handl':150C 'icon':71B,152C 'infrastructur':56B 'juli':163C 'leverag':171C 'lnk':64B,140C 'local':127C 'log':101B 'logged-on':100B 'malici':74B 'malwar':169C 'media':59B 'mere':68B 'microsoft':4A,29A,31A,34A,38A,42A,46A,49A,107C 'open':89B 'origin':166C 'pars':62B 'pif':143C 'proper':149C 'r2':19A,122C 'remot':130C 'remov':58B 'removable-media':57B 'report':167C 'run':77B,96B 'scada':178C 'server':8A,15A,36A,40A,44A,111C,118C 'share':55B 'shell':2A,105C 'shortcut':63B,75B,144C 'siemen':176C 'sp1':12A,115C 'sp2':10A,14A,17A,113C,117C,120C 'sp3':7A,110C 'system':179C 'unsaf':66B 'user':84B,103B,128C 'via':136C 'vista':11A,48A,114C 'wild':161C 'wincc':177C 'window':1A,5A,21A,60B,61B,104C,108C,124C,155C 'windows':30A,32A,35A,39A,43A,47A,50A 'xp':6A,51A,109C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2010-07-22T05:43:49+00:00","kev":{"dateAdded":"2022-09-15","dueDate":"2022-10-06","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2010-2568","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-2568","severity":null,"published_at":"2022-09-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"epss","external_id":"CVE-2010-2568","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-2568","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2010-2568","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2568","severity":null,"published_at":"2010-07-22T05:43:49+00:00","modified_at":"2026-06-16T23:20:59+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}