In mid-2009, Stuxnet was released against the Iranian nuclear program. Attributed to the United States and Israel, Stuxnet used multiple zero-day attacks against Windows to attack the Iranian centrifuges. It was discovered in June of 2010, and reported to Microsoft. The initial infection vector was a USB drive taking advantage of a vulnerability in the Windows operating system that allowed simply browsing to a directory to run arbitrary code. The directory contained a specially crafted .LNK file designed to trigger the weakness and execute code of the attacker’s choosing on the target system. In August of 2010, Microsoft released Security Bulletin MS10-046 along with a patch to shore up the weakness. The patch failed. And for more than four years, all Windows systems were vulnerable to exactly the same attack that Stuxnet used for initial deployment. In January of 2015, researcher Michael Heerklotz approached the Zero Day Initiative with a report that he had found a way to bypass the MS10-046 patch. In this paper, we look at where the patch failed, how an attacker could get around it, and how the subsequent MS15-020 update closed the vulnerability.