Windows Shell CVE-2010-2568

Apply Microsoft Security Bulletin MS10-046 released August 2010, which patches the Windows Shell .LNK and .PIF parsing vulnerability across all affected Windows versions (https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046). For systems that cannot immediately patch, Microsoft advisory 2286198 provides registry-based workaround to disable display of shortcut icons, though this degrades user experience and does not eliminate risk if users open malicious shortcuts directly. Disable AutoRun/AutoPlay features for removable media and network shares to prevent automatic code execution when directories containing weaponized .LNK files are browsed, though this does not prevent exploitation if user manually browses to directories. Restrict WEBDAV Client service and disable icon display for remote shares. Block .LNK and .PIF files at email gateways and web proxies. For industrial control systems and air-gapped networks, implement strict USB device controls and media scanning before introduction to secured environments. These compensating controls reduce attack surface but cannot substitute for patching, as Windows Explorer icon rendering occurs during normal file browsing operations. Legacy systems unable to receive MS10-046 require isolation or decommissioning.