---
id: "CVE-2010-2568"
kind: "vulnerability"
aliases: ["CVE-2010-2568"]
title: "Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7\u2026"
severity: "critical"
cvss: 9.3
epss: 0.89623
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Windows", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "microsoft windows 7", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "microsoft windows server 2003", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "microsoft windows server 2008", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "microsoft windows server 2008", "fixed": [], "affected": "= r2", "ecosystem": "vendor"}, {"name": "microsoft windows vista", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "microsoft windows xp", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "file-shares", "infrastructure", "removable-media", "windows"]
not_affected_if: ["non-windows", "patched-windows"]
published_at: "2010-07-22T05:43:49+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-2568", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2010-2568", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7…

Windows parses shortcut (.lnk) files unsafely, so merely displaying the icon of a malicious shortcut can run code. An attacker who gets a user to browse to or open a folder containing such a file runs code as that logged-on user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Windows affected ? fixed ?
- vendor:microsoft windows 7 affected ? fixed ?
- vendor:microsoft windows server 2003 affected ? fixed ?
- vendor:microsoft windows server 2008 affected ? fixed ?
- vendor:microsoft windows server 2008 affected = r2 fixed ?
- vendor:microsoft windows vista affected ? fixed ?
- vendor:microsoft windows xp affected ? fixed ?

## Fix

Apply the Microsoft update for CVE-2010-2568 per vendor instructions (CISA required action); the sources do not name the KB or patched build.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-2568
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2010-2568
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2010-2568

## From the sources

Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_