Vulnerability record · CVE-2017-8464 · published 15 June 2017
CVE-2017-8464: Windows Shell .LNK icon parsing remote code execution
Microsoft · Windows 10 1511
Windows Shell fails to properly handle a crafted .LNK shortcut when its icon is parsed by Windows Explorer or any other application that reads shortcut icons, allowing arbitrary code execution. Because .LNK files are routinely opened and rendered automatically, this is a broadly reachable code execution flaw affecting many Windows client and server versions.
Description
Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows local users or remote attackers to execute arbitrary code via a crafted .LNK file, which is not properly handled during icon display in Windows Explorer or any other application that parses the icon of the shortcut. aka "LNK Remote Code Execution Vulnerability."
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
critical priorityIt is a remotely reachable, unauthenticated code execution flaw with public exploits and confirmed exploitation in CISA KEV, despite requiring user interaction.
What it is
Windows Shell fails to properly handle a crafted .LNK shortcut when its icon is parsed by Windows Explorer or any other application that reads shortcut icons, allowing arbitrary code execution. Because .LNK files are routinely opened and rendered automatically, this is a broadly reachable code execution flaw affecting many Windows client and server versions.
Impact
An attacker gains arbitrary code execution in the context of the user or process that parses the shortcut, which on a server or administrative account can mean full system compromise.
Attack surface
Reached over the network via a crafted .LNK file delivered to a target, with no privileges required but user interaction needed to trigger icon parsing (CVSS vector AV:N/AC:L/PR:N/UI:R). Local users can also exploit it directly.
Exploitation
Listed in CISA KEV since 2022-02-10 with a required action to apply vendor updates, and EPSS 30-day probability is 0.90026 (99.8th percentile); public exploit code exists per Exploit-DB references. No ransomware campaign use is documented in this record.
What to do
- Apply the Microsoft security update for CVE-2017-8464 to all affected Windows versions, prioritizing unsupported or rarely patched systems.
- Disable or restrict automatic icon and thumbnail rendering for untrusted .LNK files where feasible.
- Block .LNK attachments and shortcut files at email and web gateways.
- Restrict execution and opening of files from untrusted network shares, USB media and downloads.
- Retire end-of-life platforms such as Windows 7, Windows 8.1 and Server 2008/2012 that no longer receive fixes.
Detection
- Monitor for .LNK file creation or modification in user-writable and startup locations.
- Alert on Explorer or shell processes spawning unexpected child processes such as script interpreters or command shells.
- Hunt for shortcut files with embedded or unusual icon paths referencing remote or non-standard locations.
- Review email and web proxy logs for .LNK attachments or downloads reaching endpoints.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2017-8464 to the Known Exploited Vulnerabilities catalog on 10 February 2022 as "Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 10 August 2022.
Affected products
9 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/98818 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1038671 | Third Party AdvisoryVDB Entry |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464 | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/42382/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/42429/ | ExploitThird Party AdvisoryVDB Entry |
| http://www.securityfocus.com/bid/98818 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1038671 | Third Party AdvisoryVDB Entry |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464 | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/42382/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/42429/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8464 | US Government Resource |
Track CVE-2017-8464 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-8464), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
