Vulnerability record · CVE-2010-1885 · published 15 June 2010
CVE-2010-1885: Windows Help and Support Center hcp:// URL validation command injection
Microsoft · Windows 2003 Server
The MPC::HexToNum function in helpctr.exe in the Windows Help and Support Center fails to properly handle malformed escape sequences, allowing a crafted hcp:// URL to bypass the trusted documents whitelist (fromHCP option). This lets a remote attacker execute arbitrary commands on Windows XP and Windows Server 2003 systems, making it a serious remote code execution flaw on those platforms.
Description
The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle malformed escape sequences, which allows remote attackers to bypass the trusted documents whitelist (fromHCP option) and execute arbitrary commands via a crafted hcp:// URL, aka "Help Center URL Validation Vulnerability."
AV:N/AC:M/Au:N/C:C/I:C/A:C
Automated analysis
high priorityRemote code execution with public exploit code and very high EPSS, but limited to legacy Windows XP and Server 2003 systems and requiring user interaction.
What it is
The MPC::HexToNum function in helpctr.exe in the Windows Help and Support Center fails to properly handle malformed escape sequences, allowing a crafted hcp:// URL to bypass the trusted documents whitelist (fromHCP option). This lets a remote attacker execute arbitrary commands on Windows XP and Windows Server 2003 systems, making it a serious remote code execution flaw on those platforms.
Impact
An attacker can execute arbitrary commands with the privileges of the user who opens the crafted URL, leading to full compromise of confidentiality, integrity and availability on the affected host.
Attack surface
Reached over the network via a crafted hcp:// URL, typically delivered through a web page or link that the victim must open. No authentication is required, but user interaction is needed to trigger the vulnerable Help Center handler.
Exploitation
Public exploit code exists (Exploit-DB 13808 and Full Disclosure references tagged Exploit), and EPSS is very high at 0.71238 (99.4th percentile), though the CVE is not listed in CISA KEV.
What to do
- Apply Microsoft security update MS10-042, which fixes the Help Center URL validation issue.
- If patching is not immediately possible, apply the workaround in Microsoft Security Advisory 2219475, such as unregistering the HCP protocol handler.
- Restrict or block hcp:// URL handling through browser and email client configuration where feasible.
- Upgrade or retire Windows XP and Windows Server 2003 systems, which are no longer supported.
- Educate users not to open unsolicited hcp:// links.
Detection
- Monitor process creation for helpctr.exe spawning cmd.exe or other unexpected child processes.
- Inspect web proxy, email gateway and browser logs for hcp:// URLs, especially those containing malformed escape sequences.
- Alert on network or host telemetry showing Help Center launching executables from unusual paths.
- Review Windows application and security event logs for anomalous helpctr.exe activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2010-1885 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2010-1885), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
