Vulnerability record · CVE-2010-1423 · published 15 April 2010
CVE-2010-1423: Java NPAPI plugin and Deployment Toolkit URI handler argument injection
Oracle · Jdk
The URI handler in the Java NPAPI plugin and Java Deployment Toolkit fails to sanitize arguments passed to javaws.exe, allowing an attacker to inject -J or -XXaltjvm options that the launch method processes. Because these arguments can redirect the JVM to attacker-controlled code, the flaw enables remote code execution on affected Windows (and possibly Linux) systems running Java 6 Update 10, 19 and other versions.
Description
Argument injection vulnerability in the URI handler in (a) Java NPAPI plugin and (b) Java Deployment Toolkit in Java 6 Update 10, 19, and other versions, when running on Windows and possibly on Linux, allows remote attackers to execute arbitrary code via the (1) -J or (2) -XXaltjvm argument to javaws.exe, which is processed by the launch method. NOTE: some of these details are obtained from third party information.
AV:N/AC:M/Au:N/C:C/I:C/A:C
Automated analysis
high priorityRemote code execution with complete impact and public exploit code, though the flaw is old and patched, so risk depends on unpatched legacy Java deployments.
What it is
The URI handler in the Java NPAPI plugin and Java Deployment Toolkit fails to sanitize arguments passed to javaws.exe, allowing an attacker to inject -J or -XXaltjvm options that the launch method processes. Because these arguments can redirect the JVM to attacker-controlled code, the flaw enables remote code execution on affected Windows (and possibly Linux) systems running Java 6 Update 10, 19 and other versions.
Impact
An attacker can execute arbitrary code with the privileges of the user running the browser or Java process, leading to full system compromise. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as complete.
Attack surface
Reached remotely over the network via a crafted URI that invokes the Java URI handler, requiring no authentication. Some user interaction is implied by the AC:M vector, such as visiting a malicious page or clicking a link that triggers the handler.
Exploitation
Not listed in CISA KEV, but EPSS is 0.5558 (99th percentile) and a reference is tagged Exploit, indicating public exploit code exists and exploitation is plausible.
What to do
- Apply the vendor patch referenced in the Oracle advisory (vupen.com advisory 2010/0853) or upgrade to a fixed Java release.
- Disable or remove the Java NPAPI browser plugin and Java Deployment Toolkit where not required.
- Restrict execution of javaws.exe and block untrusted URI handler invocations via application control or browser policy.
- Educate users not to open unsolicited links or pages that trigger the Java Web Start handler.
Detection
- Monitor process creation for javaws.exe with -J or -XXaltjvm arguments, especially when spawned from browser processes.
- Alert on browser or Java processes making outbound network connections to untrusted hosts after URI handler invocation.
- Review Java Deployment Toolkit and NPAPI plugin usage in endpoint inventories and flag hosts still running affected Java 6 versions.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2010-1423 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2010-1423), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
