CVE-2017-8464highunder attack

CVE-2017-8464: high-severity vulnerability in Microsoft Corporation Windows Shell

Published 15 Jun 2017 · Updated 21 Oct 2025

Follow this CVE + Monitor Windows + Monitor Windows Shell

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.8epss 90%

from disclosure to weaponsame day

Published on NVDJun 15

1st PoCFeb 24

metasploitJun 13

CISA KEV+1701d

Action required by CISAfederal deadline: 2022-08-10

Apply updates per vendor instructions.

In short

Windows can be tricked into running harmful code when you open a specially crafted shortcut file (.LNK). This happens because Windows doesn't safely check the icon inside the shortcut before displaying it.

Technical detail

A malicious .LNK file exploits improper validation of icon data in the Windows Shell icon handler, allowing arbitrary code execution when the shortcut's icon is parsed by Windows Explorer or any application that reads shortcut metadata. This affects local and remote attack scenarios with no user interaction beyond opening or viewing the file in an explorer context.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows local users or remote attackers to execute arbitrary code via a crafted .LNK file, which is not properly handled during icon display in Windows Explorer or any other application that parses the icon of the shortcut. aka "LNK Remote Code Execution Vulnerability."

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Microsoft Corporation · Windows Shell

public PoCs found — 17

exploitdbwww.exploit-db.com/exploits/42429unverified exploitdbwww.exploit-db.com/exploits/42382unverified githubgithub.com/3gstudent/CVE-2017-8464-EXP★ 67 githubgithub.com/doudouhala/CVE-2017-8464-exp-generator★ 8 githubgithub.com/TrG-1999/DetectPacket-CVE-2017-8464★ 3 githubgithub.com/xssfile/CVE-2017-8464-EXP★ 1 githubgithub.com/Elm0D/CVE-2017-8464★ 1 githubgithub.com/X-Vector/usbhijacking★ 0 githubgithub.com/TieuLong21Prosper/Detect-CVE-2017-8464★ 0 githubgithub.com/PlayBoiSK8/POC-CVE-2017-8464-OpenCalculator★ 0 githubgithub.com/tuankiethkt020/Phat-hien-CVE-2017-8464★ 0 vulncheckvulncheck.com/xdb/ce45ace27de3unverified vulncheckvulncheck.com/xdb/40020c9d725bunverified vulncheckvulncheck.com/xdb/4680b98695ebunverified vulncheckvulncheck.com/xdb/6bd690a6cb72unverified cve_referencewww.exploit-db.com/exploits/42429/unverified cve_referencewww.exploit-db.com/exploits/42382/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — Microsoft Corporation Windows Shell

In the same product, most dangerous first.

CVE-2017-8699—CVE-2017-8699EPSS 21.3%CVE-2018-0883—CVE-2018-0883EPSS 14.5%CVE-2017-8591—CVE-2017-8591EPSS 4.0%

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8464 https://www.exploit-db.com/exploits/42382/https://www.exploit-db.com/exploits/42429/http://www.securityfocus.com/bid/98818 http://www.securitytracker.com/id/1038671