Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Wind…

published 2017-06-15 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-17414

cvss: 8.8; version 3.1, CNA
cisa kev: Exploited; added 2022-02-10
epss: 90.0%; EPSS 90.0% chance of exploitation in 30 days, percentile 99.7%
public exploits: 4; Metasploit, Exploit-DB

Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows local users or remote attackers to execute arbitrary code via a crafted .LNK file, which is not properly handled during icon display in Windows Explorer or any other application that parses the icon of the shortcut. aka "LNK Remote Code Execution Vulnerability."

Patch / fix

cisa required action Apply updates per vendor instructions.

links 1

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464 advisory

Timeline

2017-06-13 0-day patched (Project Zero)
2017-06-13 First public exploit (Metasploit exploit/windows/fileformat/cve_2017_8464_lnk_rce)
2017-06-15 Published
2022-02-10 Added to CISA KEV
2022-08-10 CISA patch deadline
2025-02-10 CISA SSVC: exploitation active

Known exploited

Added: 4 y ago (2022-02-10)
Patch by: 2022-08-10 (4 y ago)
Ransomware: Not known
Required action: Apply updates per vendor instructions.
Vendor, product: Microsoft, Windows
CISA name: Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability

Zero-day

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Patched: 2017-06-13
Details: project zero tracker

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: total
Assessed: 20 mo ago (2025-02-10)

Exploit prediction

90.03% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/windows/fileformat/cve_2017_8464_lnk_rce LNK Code Execution Vulnerability metasploit exploit, great rank, 2017-06-13
Metasploit exploit/windows/local/cve_2017_8464_lnk_lpe LNK Code Execution Vulnerability metasploit exploit, great rank, 2017-06-13
EDB-42429 Microsoft Windows - '.LNK' Shortcut File Code Execution local, 2017-08-06
EDB-42382 Microsoft Windows - '.LNK' Shortcut File Code Execution (Metasploit) local, 2017-07-26

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	9.3	AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

Microsoft Corporation Windows Shell

References

portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2017-8464
patch, vendor-advisory
exploit-db.com /exploits/42382/
exploit, third-party-advisory, vdb-entry
exploit-db.com /exploits/42429/
exploit, third-party-advisory, vdb-entry
securitytracker.com /id/1038671
vdb-entry, third-party-advisory
securityfocus.com /bid/98818
vdb-entry, third-party-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8464
government-resource, us-government-resource

Sources

CVE List CVE-2017-8464
NVD CVE-2017-8464

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary