HighPublic exploit

Win32k Keyboard Layout Vulnerability

IdentifiersCVE-2010-2743CWE-129

CVE-2010-2743 is a local privilege-escalation vulnerability in Microsoft Windows XP SP3 kernel-mode keyboard layout handling. During keyboard layout loading through NtUserLoadKeyboardLayoutEx, attacker-controlled layout data can influence an improperly validated function-pointer table index. A crafted keyboard code mapping can redirect privileged execution into attacker-controlled user-space memory, executing user-provided code in supervisor mode. Stuxnet exploited the vulnerability in the wild in July 2010; Carberp also used it for privilege escalation. The identifier may duplicate CVE-2010-3888 or CVE-2010-3889.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation elevates a local attacker's execution from user mode to supervisor mode. The affected keyboard dispatch routine executes with system privilege, allowing attacker-controlled code to run with elevated operating-system privileges.

Mitigation

If you can’t patch tonight, do this now.

Supervisor Mode Execution Protection (SMEP), where supported by both the processor and operating system and enabled, can block the described redirection into user-space executable memory by generating a page fault. SMEP was first available with Intel Ivy Bridge processors; its applicability to the affected Windows XP SP3 environment is not established.

Remediation

Patch, then assume compromise.

Apply the Microsoft Windows security updates addressing the Win32k keyboard layout vulnerability associated with MS10-073. A specific update package or fixed build is not identified in the available information.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).

VALID 1 / 2 TOTALView more in app

ms10_073_kbdlayout.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit post-exploitation module targeting the Windows NtUserLoadKeyboardLayoutEx privilege escalation vulnerability (CVE-2010-2743, MS10-073). The exploit leverages a flaw in the Windows kernel's handling of keyboard layout DLLs, allowing an attacker to execute code in kernel mode (Ring 0) by loading a specially crafted DLL. The module is designed to be run from a Meterpreter session on a vulnerable Windows system (Windows 2000 to XP SP2). It assembles and injects custom shellcode that manipulates process tokens to grant SYSTEM privileges. The exploit requires the ability to write a DLL to disk and load it as a keyboard layout. The repository is structured as a single Ruby file, following Metasploit conventions, and does not contain any network endpoints or external IPs/domains. Its primary purpose is to provide local privilege escalation on legacy Windows systems vulnerable to this kernel bug.

Disclosed Oct 12, 2010rubylocal

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationWindows 2003 Serveroperating_system

Microsoft CorporationWindows 7operating_system

Microsoft CorporationWindows Server 2003operating_system

Microsoft CorporationWindows Server 2008operating_system

Microsoft CorporationWindows Vistaoperating_system

Microsoft CorporationWindows Xpoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Exploitation for Privilege Escalation, Technique T1068 - Enterprise | MITRE ATT&CK®

A Windows vulnerability exploited by Carberp for privilege escalation.

mitre attackNews

Jan 24, 2026

Exploitation for Privilege Escalation, Technique T1068 - Enterprise | MITRE ATT&CK®

Windows privilege escalation vulnerability exploited by Carberp.

mitre attackNews

Mar 18, 2026

Exploitation for Privilege Escalation, Technique T1068 - Enterprise | MITRE ATT&CK®

Windows privilege escalation vulnerability exploited by Carberp.

mitre attackNews

Mar 18, 2026

Exploitation for Privilege Escalation, Technique T1068 - Enterprise | MITRE ATT&CK®

Windows privilege escalation vulnerability exploited by Carberp.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware5

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2