Vulnerability record · CVE-2010-2568 · published 22 July 2010
CVE-2010-2568: Windows Shell LNK/PIF Shortcut Icon Parsing Remote Code Execution
Microsoft · Windows 7
Windows Shell fails to properly handle crafted .LNK or .PIF shortcut files during icon display in Windows Explorer, allowing arbitrary code execution. This is the Stuxnet-era shortcut flaw, originally observed in the wild in July 2010 and linked to malware abusing CVE-2010-2772 in Siemens WinCC SCADA systems. It matters because a simple file listing or USB drive can trigger execution on unpatched Windows XP through Windows 7 and Server 2008 R2 systems.
Description
Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
critical priorityIt is in CISA KEV with a near-maximum EPSS score and confirmed in-the-wild exploitation, and it affects widely deployed legacy Windows versions that are often unpatchable.
What it is
Windows Shell fails to properly handle crafted .LNK or .PIF shortcut files during icon display in Windows Explorer, allowing arbitrary code execution. This is the Stuxnet-era shortcut flaw, originally observed in the wild in July 2010 and linked to malware abusing CVE-2010-2772 in Siemens WinCC SCADA systems. It matters because a simple file listing or USB drive can trigger execution on unpatched Windows XP through Windows 7 and Server 2008 R2 systems.
Impact
An attacker gains arbitrary code execution in the context of the user who views the shortcut, enabling malware installation, persistence and lateral movement. Because the flaw is reachable from Explorer icon rendering, no elevated privileges are required beyond the victim's own account.
Attack surface
Reached locally or remotely by delivering a malicious .LNK or .PIF file that is rendered by Windows Explorer; the CVSS vector is AV:L with UI:R, so the attacker needs the victim to view or list the file, and no authentication is required. Removable media, network shares and archive contents are plausible delivery paths given the description.
Exploitation
CISA added it to KEV on 2022-09-15 with a 2022-10-06 remediation due date, and EPSS shows a 30-day probability of 0.91324 (99.805th percentile). Multiple references are tagged Exploit, and the description states it was demonstrated in the wild in July 2010.
What to do
- Apply Microsoft security update MS10-046 (KB2286198) to all affected Windows XP, Server 2003, Vista, Server 2008 and Windows 7 systems.
- Disable or restrict rendering of .LNK and .PIF icons where feasible, and block shortcut files from untrusted sources such as email, web downloads and removable media.
- Enforce USB device controls and scan removable media before mounting or browsing it in Explorer.
- Retire or isolate unsupported Windows XP and Server 2003 systems that cannot receive the patch.
- Apply the vendor workaround in Microsoft advisory 2286198 on systems that cannot be patched immediately.
Detection
- Monitor for Explorer or shell processes spawning unexpected child processes after a .LNK or .PIF file is accessed.
- Hunt for .LNK and .PIF files written to user-writable or removable-media paths and correlate with subsequent process creation.
- Alert on shortcut files with anomalous icon-path or command strings, especially those referencing external drives or network paths.
- Review endpoint telemetry for known Stuxnet-related indicators and for CVE-2010-2772 activity in Siemens WinCC environments.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2010-2568 to the Known Exploited Vulnerabilities catalog on 15 September 2022 as "Microsoft Windows Remote Code Execution Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 6 October 2022.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2010-2568 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2010-2568), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
