The kernel-mode drivers in Microsoft Windows XP SP3 do not properly perform indexing of a function-pointer…

CVE-2010-2743 is a local privilege escalation in the Windows kernel-mode driver win32k.sys. The xxxKENLSProcs function fails to validate an array index into a function-pointer table when loading keyboard layout files from disk. By crafting a malicious keyboard layout DLL, a local attacker triggers an out-of-bounds call (CALL _aNLSVKFProc[ecx*4]) and achieves arbitrary code execution in Ring 0 — full SYSTEM. Affected versions span Windows 2000, XP SP3, Server 2003 SP2, Vista, Server 2008, Windows 7, and Server 2008 R2. The patch shipped as MS10-073 in October 2010.

Microsoft rated this Important (not Critical), which was fair at the time given the local-access prerequisite. In 2026, the vendor severity is irrelevant because *every* affected OS version is end-of-life. Windows XP holds roughly 0.2% of global desktop share; Server 2003 is effectively zero outside air-gapped OT enclaves. Any unpatched host has hundreds of other unpatched CVEs of equal or greater severity. This specific CVE adds negligible marginal risk to a modern fleet.

Why this verdict

• Extinct target population: Every affected OS (XP through Server 2008 R2) is end-of-life. StatCounter and Enlyft data show XP at ~0.2% of desktops globally. In a managed 10,000-host enterprise, the expected count of affected hosts rounds to zero.
• Local access prerequisite: CVSS vector is AV:L — the attacker must already have code execution on the target. On an air-gapped OT host running XP, getting local access is the hard part; once there, dozens of other unpatched kernel vulns are equally available.
• Role multiplier: The affected component is win32k.sys, a kernel-mode driver — on paper this is a high-value target (kernel-mode = SYSTEM). However, the *platforms* where it is unpatched are (a) workstation-class XP desktops (low-value, <0.1% of fleet), (b) OT/ICS HMIs running XP Embedded (high-value for safety, but air-gapped and not addressable via this CVE's patch anyway since they're EOL), (c) legacy Server 2003/2008 (should have been decommissioned years ago). The high-value OT role is real but the blast radius is contained by network segmentation, and the marginal risk from *this specific CVE* vs. the hundreds of other unpatched vulns on those hosts is negligible. The floor test is not triggered because <1% of the installed base occupies an unsegmented high-value role.
• Patch available for 16 years: MS10-073 shipped in October 2010. Any host that remains unpatched in 2026 is unpatched for *everything* — this CVE is not the limiting factor in its risk posture.
• No current exploitation: Despite Stuxnet's historical use, there is no evidence of active 2026 campaigns targeting this CVE. Not KEV-listed.

Why not higher?

Upgrading to MEDIUM or above would require a meaningful population of reachable, unpatched hosts. With every affected OS version EOL for 5–16 years and global install share below 0.5%, the vulnerability has no operational attack surface in a modern enterprise. The Stuxnet pedigree is historically significant but does not translate to current risk.

Why not lower?

IGNORE would be appropriate if no affected hosts could plausibly exist. Residual XP Embedded deployments in OT, medical, and ATM environments are documented and real, even if small and segmented. For enterprises with any legacy OT footprint, this CVE should remain on the radar as part of EOL-host risk tracking — it's not zero-risk, just very low.

1. Inventory and segment all EOL Windows hosts — Use asset discovery (Qualys, Tenable, Lansweeper) to find any surviving XP/2003/Vista/2008 hosts. Place them on isolated VLANs with deny-by-default firewall rules. This is the only meaningful control since the hosts cannot be patched to current OS levels. No mitigation SLA applies (LOW verdict) — treat as backlog hygiene.
2. Disable interactive logon where possible — For XP Embedded kiosks and HMIs, restrict logon to service accounts only. Remove keyboard/USB HID access to prevent local exploitation. This reduces the local-access prerequisite to near-impossible.
3. Plan OS migration for remaining EOL hosts — The real fix is decommissioning XP/2003/2008. Build a migration roadmap to Windows 10/11 or Server 2022. For OT hosts where migration requires hardware replacement, budget and schedule accordingly.

Run this from an auditor workstation with network access to target hosts. Pass the target hostname as an argument: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2010-2743.ps1 -ComputerName TARGET01. Requires WMI/WinRM access (domain admin or local admin credentials).

#Requires -Version 3.0
param(
    [Parameter(Mandatory=$true)]
    [string]$ComputerName
)

# Check-CVE-2010-2743.ps1
# Determines if a remote host is vulnerable to CVE-2010-2743 (MS10-073)
# Outputs: VULNERABLE / PATCHED / NOT_AFFECTED / UNKNOWN

try {
    $os = Get-WmiObject -Class Win32_OperatingSystem -ComputerName $ComputerName -ErrorAction Stop
    $caption = $os.Caption
    $version = [version]$os.Version

    # Only XP (5.1), Server 2003 (5.2), Vista/2008 (6.0), 7/2008R2 (6.1) are affected
    $affectedMajorMinor = @('5.1','5.2','6.0','6.1')
    $osKey = "$($version.Major).$($version.Minor)"

    if ($affectedMajorMinor -notcontains $osKey) {
        Write-Host "NOT_AFFECTED — $caption ($($os.Version)) is not in the affected OS range."
        exit 0
    }

    # Check for MS10-073 hotfix KB981957
    $hotfix = Get-WmiObject -Query "SELECT HotFixID FROM Win32_QuickFixEngineering WHERE HotFixID='KB981957'" -ComputerName $ComputerName -ErrorAction SilentlyContinue

    if ($hotfix) {
        Write-Host "PATCHED — $caption has KB981957 (MS10-073) installed."
        exit 0
    } else {
        # Double-check via win32k.sys file version (post-patch versions vary by OS)
        Write-Host "VULNERABLE — $caption ($($os.Version)) is in the affected range and KB981957 is NOT installed."
        Write-Host "NOTE: This host is running an END-OF-LIFE operating system with likely hundreds of other unpatched vulnerabilities."
        exit 1
    }
} catch {
    Write-Host "UNKNOWN — Could not connect to $ComputerName or retrieve OS info. Error: $($_.Exception.Message)"
    exit 2
}

Sources

1. NVD — CVE-2010-2743
2. Microsoft Security Bulletin MS10-073
3. Exploit-DB — MS10-073 Keyboard Layout Exploit (EDB-15985)
4. Tenable Nessus Plugin 49950
5. CVE Details — CVE-2010-2743
6. Technical Analysis of Win32K.sys Stuxnet Exploit
7. Enlyft — Windows XP Market Share