CVE-2010-2568: Microsoft Windows Remote Code Execution Vulnerability

CISA Known Exploited Vulnerabilities

Name

Microsoft Windows Remote Code Execution Vulnerability

Vendor

Microsoft

Product

Windows

Added to the catalog

2022-09-15

Due date for US federal agencies

2022-10-06

Weaknesses

CWE-20

Catalog version

2026.10.30

Microsoft Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the operating system displays the icon of a malicious shortcut file. An attacker who successfully exploited this vulnerability could execute code as the logged-on user.

Required action (CISA)

Apply updates per vendor instructions.

Ransomware use: CISA does not mark known use of this vulnerability in ransomware campaigns.

Links in CISA's notes

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046
• https://nvd.nist.gov/vuln/detail/CVE-2010-2568

Read on 2026-11-02T23:39:54.475Z under licence cisa-kev-cc0@b0067899 from https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

NVD analysis

Status

Analyzed

Published

2010-07-22T05:43:49.703

Last modified

2026-06-16T23:20:59.973

Weaknesses

NVD-CWE-noinfo

Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.

References

• http://isc.sans.edu/diary.html?storyid=9181 (Exploit, Issue Tracking)
• http://isc.sans.edu/diary.html?storyid=9190 (Issue Tracking)
• http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/ (Press/Media Coverage)
• http://secunia.com/advisories/40647 (Vendor Advisory)
• http://securitytracker.com/id?1024216 (Broken Link, Third Party Advisory, VDB Entry)
• http://www.f-secure.com/weblog/archives/00001986.html (Not Applicable)
• http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf (Exploit)
• http://www.kb.cert.org/vuls/id/940193 (Patch, Third Party Advisory, US Government Resource)
• http://www.microsoft.com/technet/security/advisory/2286198.mspx (Broken Link, Patch, Vendor Advisory)
• http://www.securityfocus.com/bid/41732 (Broken Link, Exploit, Third Party Advisory, VDB Entry)
• http://www.us-cert.gov/cas/techalerts/TA10-222A.html (Third Party Advisory, US Government Resource)
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046 (Patch, Vendor Advisory)
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11564 (Broken Link)
• https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm (Third Party Advisory)
• http://isc.sans.edu/diary.html?storyid=9181 (Exploit, Issue Tracking)
• http://isc.sans.edu/diary.html?storyid=9190 (Issue Tracking)
• http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/ (Press/Media Coverage)
• http://secunia.com/advisories/40647 (Vendor Advisory)
• http://securitytracker.com/id?1024216 (Broken Link, Third Party Advisory, VDB Entry)
• http://www.f-secure.com/weblog/archives/00001986.html (Not Applicable)
• http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf (Exploit)
• http://www.kb.cert.org/vuls/id/940193 (Patch, Third Party Advisory, US Government Resource)
• http://www.microsoft.com/technet/security/advisory/2286198.mspx (Broken Link, Patch, Vendor Advisory)
• http://www.securityfocus.com/bid/41732 (Broken Link, Exploit, Third Party Advisory, VDB Entry)
• http://www.us-cert.gov/cas/techalerts/TA10-222A.html (Third Party Advisory, US Government Resource)
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046 (Patch, Vendor Advisory)
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11564 (Broken Link)
• https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm (Third Party Advisory)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2568 (US Government Resource)

This product uses the NVD API but is not endorsed or certified by the NVD.

Read on 2026-11-02T23:41:28.906Z under licence nvd-api-terms-of-use@ff2a5288 from https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2010-2568

CVE record

Assigner

microsoft

State

PUBLISHED

Published

2010-07-22T10:00:00.000Z

Updated

2025-10-22T00:05:52.095Z

Problem types

n/a

Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.

References

• TA10-222A
• http://isc.sans.edu/diary.html?storyid=9181
• oval:org.mitre.oval:def:11564
• http://www.f-secure.com/weblog/archives/00001986.html
• VU#940193
• http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/
• 40647
• http://www.microsoft.com/technet/security/advisory/2286198.mspx
• http://isc.sans.edu/diary.html?storyid=9190
• 41732
• http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf
• https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm
• 1024216
• MS10-046

Read on 2026-11-03T00:12:44.060Z under licence cve-terms-of-use@81bfa2f3 from https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/2xxx/CVE-2010-2568.json