8.8 High Exploited

CVE-2017-8464 Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Not observed so far

Description

Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows local users or remote attackers to execute arbitrary code via a crafted .LNK file, which is not properly handled during icon display in Windows Explorer or any other application that parses the icon of the shortcut. aka "LNK Remote Code Execution Vulnerability."

Affected products and versions

Product	Affected versions	Fixed in
Windows Shell	Versions not published

References

42382 www.exploit-db.com
portal.msrc.microsoft.com portal.msrc.microsoft.com
42429 www.exploit-db.com
1038671 www.securitytracker.com
98818 www.securityfocus.com

Timeline

Published June 15, 2017
Added to the KEV catalogue February 10, 2022
Last modified October 21, 2025

The 4 CVEs of Windows Shell →

CVE-2018-0883 Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server… Not rated CVE-2017-8699 Windows Shell in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server… Not rated CVE-2017-8591 Windows Input Method Editor (IME) in Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold,… Not rated

Track this CVE