High severity · published Jun 15, 2017
CVE-2017-8464
Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability
In wildKEV
8.8
CVSS
90%
EPSS
Yes
On KEV
Description
Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows local users or remote attackers to execute arbitrary code via a crafted .LNK file, which is not properly handled during icon display in Windows Explorer or any other application that parses the icon of the shortcut. aka "LNK Remote Code Execution Vulnerability."
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)90.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Feb 10, 2022
Federal remediation dueAug 10, 2022
Ransomware campaign useNot known
Affected products
Which versions
WI
Windows · Microsoft
All versions, or not specified · source: KEV
WS
Windows Shell · Microsoft Corporation
Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 · source: vendor
W1
Windows 10 1511 · Microsoft
All versions, or not specified · source: NVD
W1
Windows 10 1607 · Microsoft
All versions, or not specified · source: NVD
W1
Windows 10 1703 · Microsoft
All versions, or not specified · source: NVD
W7
Windows 7 · Microsoft
All versions, or not specified · source: NVD
W8
Windows 8.1 · Microsoft
All versions, or not specified · source: NVD
WR
Windows RT 8.1 · Microsoft
All versions, or not specified · source: NVD
WS
Windows Server 2008 · Microsoft
r2; r2 · source: NVD
WS
Windows Server 2012 · Microsoft
r2 · source: NVD
WS
Windows Server 2016 · Microsoft
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-8464
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-8464
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
exploit
https://www.exploit-db.com/exploits/42382/
x_refsource_CONFIRM
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464
exploit
https://www.exploit-db.com/exploits/42429/
vdb-entry
http://www.securitytracker.com/id/1038671
vdb-entry
http://www.securityfocus.com/bid/98818
More from Windows
10.0
CVE-2020-1350
Microsoft Windows DNS Server Remote Code Execution Vulnerability
9.8
CVE-2025-59287
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
9.8
CVE-2019-0708
Microsoft Remote Desktop Services Remote Code Execution Vulnerability
9.8
CVE-2017-8543
Microsoft Windows Search Remote Code Execution Vulnerability
9.8
CVE-2008-4250
Microsoft Windows Buffer Overflow Vulnerability