CVE-2010-0483: VBScript MsgBox helpfile argument enables remote code execution via winhlp32.exe

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw gives remote code execution with public exploit code and a very high EPSS score, but exploitation requires the victim to press F1 and affects only legacy Windows versions, so it is high rather than critical.

What it is

VBScript 5.1 through 5.8 on Windows 2000, XP and Server 2003 fails to safely handle the helpfile argument of the MsgBox function when Internet Explorer renders the script. A crafted .hlp file referenced by local path, UNC share or WebDAV server is loaded by winhlp32.exe when the user presses F1, allowing arbitrary code execution. The flaw matters because it turns a simple help-keypress into a full code execution path on then-current Windows clients and servers.

Impact

An attacker gains arbitrary code execution in the context of the logged-on user, with full confidentiality, integrity and availability impact per the CVSS vector. Because the code runs through winhlp32.exe, it can be used to install malware or take over the host.

Attack surface

Reached remotely over the network through Internet Explorer rendering attacker-controlled VBScript; the CVSS vector AV:N/AC:H/Au:N indicates no authentication is required but exploitation is difficult. User interaction is required: the victim must press F1 while the malicious MsgBox is displayed, and the referenced .hlp file must be reachable via local path, UNC share or WebDAV.

Exploitation

Public exploit code exists, including an iSEC Partners advisory and a Metasploit browser module, and EPSS is very high at 0.86367 (99.7th percentile). The CVE is not listed in CISA KEV and no ransomware groups are documented using it.

What to do

• Apply Microsoft security bulletin MS10-022, which fixes the VBScript helpfile handling issue, as the primary action.
• If patching cannot be done immediately, apply the interim workarounds in Microsoft Security Advisory 981169, such as disabling the F1 key help behavior or restricting winhlp32.exe.
• Block or restrict access to untrusted UNC and WebDAV paths from browsers and endpoints to prevent loading of remote .hlp files.
• Disable or tightly control VBScript execution in Internet Explorer for untrusted sites via zone and ActiveX/scripting settings.
• Retire or isolate Windows 2000, XP and Server 2003 systems that cannot receive current security updates.

Detection

• Monitor for winhlp32.exe spawning from iexplore.exe or other browser processes, especially with .hlp file arguments pointing to UNC or WebDAV paths.
• Alert on browser processes loading .hlp files from remote shares or WebDAV servers.
• Hunt for VBScript MsgBox calls that pass a helpfile argument referencing a local path, UNC share or WebDAV URL.
• Review proxy and network logs for .hlp file downloads or WebDAV access originating from browser sessions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.