CVE-2010-1885
The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle...
- Published
- Jun 14, 2010
- Updated
- Aug 7, 2024
- Assigning CNA
- microsoft
- Evidence observed
- Jun 10, 2010
Primary CVSS
nvd · CVSS 2.0
AV:N/AC:M/Au:N/C:C/I:C/A:CHigh · next 30 days
- Percentile
- 99.4%
- Model date
- Oct 13, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle malformed escape sequences, which allows remote attackers to bypass the trusted documents whitelist (fromHCP option) and execute arbitrary commands via a crafted hcp:// URL, aka "Help Center URL Validation Vulnerability."
Sources
modules/exploits/windows/browser/ms10_042_helpctr_xss_cmd_exec.rb
Metasploit Framework modulesDeclared conditions
- platform: Windows($.exploit_windows/browser/ms10_042_helpctr_xss_cmd_exec.platform)
- verification: check_not_declared($.exploit_windows/browser/ms10_042_helpctr_xss_cmd_exec.check)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.