Loading vulnerability…
A local elevation-of-privilege vulnerability in kernel-mode components of Microsoft Windows XP SP3 arises from improper indexing of a function-pointer table while loading keyboard layouts from disk. By supplying crafted input through a malicious local application, an attacker can trigger incorrect function-pointer resolution in the Win32k keyboard layout handling path and execute code with elevated privileges in kernel context. The issue became notable for its use by Stuxnet and has also been associated with Carberp activity. Public reporting notes possible duplication with CVE-2010-3888 or CVE-2010-3889.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a single Metasploit post-exploitation module targeting the Windows NtUserLoadKeyboardLayoutEx privilege escalation vulnerability (CVE-2010-2743, MS10-073). The exploit leverages a flaw in the Windows kernel's handling of keyboard layout DLLs, allowing an attacker to execute code in kernel mode (Ring 0) by loading a specially crafted DLL. The module is designed to be run from a Meterpreter session on a vulnerable Windows system (Windows 2000 to XP SP2). It assembles and injects custom shellcode that manipulates process tokens to grant SYSTEM privileges. The exploit requires the ability to write a DLL to disk and load it as a keyboard layout. The repository is structured as a single Ruby file, following Metasploit conventions, and does not contain any network endpoints or external IPs/domains. Its primary purpose is to provide local privilege escalation on legacy Windows systems vulnerable to this kernel bug.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Windows privilege escalation vulnerability exploited by Carberp.
Windows privilege escalation vulnerability exploited by Carberp.
Windows privilege escalation vulnerability exploited by Carberp.
A Windows keyboard layout elevation of privilege vulnerability used by Stuxnet on the air-gapped side for persistence/privilege escalation.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.