Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV · NVD published 2010-07-22

CVE-2010-2568

Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.

  1. First PoC
  2. 4584 days →Metasploit
  3. 1352 days →First cited attacker

Signals

Exploited in the wild
Yesadded 2022-09-15 · due 2022-10-06. An observation, not a forecast.
EPSS · 30-day forecast
91%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · HIGH
7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

5 known · links only

Metasploit3

  1. FannyBMP or DementiaWheel Detection Registry Check ↗

    This module searches for the Fanny.bmp worm related reg keys. fannybmp is a worm that exploited zero day vulns (more specifically, the LNK Exploit CVE-2010-2568). Which allowed it to spread even if USB Autorun was turned off. This is the same exploit that was used in StuxNet.

    ruby · seen 2026-10-18

  2. Microsoft Windows Shell LNK Code Execution ↗

    This module exploits a vulnerability in the handling of Windows Shortcut files (.LNK) that contain an icon resource pointing to a malicious DLL. This module creates a WebDAV service that can be used to run an arbitrary payload when accessed as a UNC path.

    ruby · seen 2026-10-18

  3. Microsoft Windows Shell LNK Code Execution ↗

    This module exploits a vulnerability in the handling of Windows Shortcut files (.LNK) that contain an icon resource pointing to a malicious DLL. This creates an SMB resource to provide the payload inside a DLL, and generates a LNK file which must be sent to the target.

    ruby · seen 2026-10-18

Exploit-DB2

  1. Microsoft Windows - Automatic .LNK Shortcut File Code Execution ↗

    created 2010-07-18

  2. Microsoft Windows - Shell LNK Code Execution (MS10-046) (Metasploit) ↗

    created 2010-09-21

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.