# CVE-2017-8464

Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows local users or remote attackers to execute arbitrary code via a crafted .LNK file, which is not properly handled during icon display in Windows Explorer or any other application that parses the icon of the shortcut. aka "LNK Remote Code Execution Vulnerability."

- Page: https://www.vulneraibility.com/cve/CVE-2017-8464
- CVSS: 8.8
- Known exploited: yes, in CISA KEV since 2022-02-10; CISA due date 2022-08-10
- EPSS: 90.03% (percentile 99.8)
- Public exploit code: 2 on Exploit-DB · 2 Metasploit modules · 9 GitHub proofs of concept (first 2017-07-26)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-02-10)
- Published: 2017-06-15

## Affected versions

- Microsoft Corporation Windows Shell: affected Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016

A version outside these ranges is not a statement that it is unaffected.

## References

- [exploit] https://www.exploit-db.com/exploits/42382/
- [other] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464
- [exploit] https://www.exploit-db.com/exploits/42429/
- [other] http://www.securitytracker.com/id/1038671
- [other] http://www.securityfocus.com/bid/98818
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8464

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.