← CVE Radar
CVE-2017-8464Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability
Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows local users or remote attackers to execute arbitrary code via a crafted .LNK file, which is not properly handled during icon display in Windows Explorer or any other application that parses the icon of the shortcut. aka "LNK Remote Code Execution Vulnerability."
8.8 HIGHEPSS 90.02%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.8 | HIGH | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 9.3 | HIGH | 2.0NVD | AV:N/AC:M/Au:N/C:C/I:C/A:C |
CISA required action
⚡ Known exploited · remediation due Aug 10, 2022
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2017-8464
- Status
- Analyzed
- Assigner (CNA)
- microsoft
- Published
- Jun 15, 2017
- Last modified
- 2026-06-17 01:26 UTC
Affected Products
As published by the CNA in the CVE record.
Microsoft CorporationWindows Shell1 version range
- Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016
References
- securityfocus.com http://www.securityfocus.com/bid/98818
- securitytracker.com http://www.securitytracker.com/id/1038671
- portal.msrc.microsoft.com https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464
- exploit-db.com https://www.exploit-db.com/exploits/42382/
- exploit-db.com https://www.exploit-db.com/exploits/42429/
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8464