CVE-2017-8464
Microsoft Corporation Windows Shell
Published 15 Jun 2017 · updated 17 Jun 2026 · Analyzed
Exploited in the wild
CISA added this to its Known Exploited Vulnerabilities catalog on 10 Feb 2022, with a remediation deadline of 10 Aug 2022 for US federal agencies.
Required action: Apply updates per vendor instructions.
Description
Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows local users or remote attackers to execute arbitrary code via a crafted .LNK file, which is not properly handled during icon display in Windows Explorer or any other application that parses the icon of the shortcut. aka "LNK Remote Code Execution Vulnerability."
References
- www.securityfocus.com/bid/98818 · Third Party Advisory, VDB Entry
- www.securitytracker.com/id/1038671 · Third Party Advisory, VDB Entry
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464 · Patch, Vendor Advisory
- www.exploit-db.com/exploits/42382/ · Exploit, Third Party Advisory, VDB Entry
- www.exploit-db.com/exploits/42429/ · Exploit, Third Party Advisory, VDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8464 · US Government Resource