{"id":"CVE-2017-8464","published":"2017-06-15T01:29:02Z","modified":"2026-06-17T01:26:24Z","title":"Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows local users or remote attackers to execute arbitrary code via a crafted .LNK file, which is not properly handled during icon display in Windows Explorer or any other application that parses the icon of the shortcut. aka \"LNK Remote Code Execution Vulnerability.\"","provenance":"source","from":"NVD"},"summary":{"text":"A flaw in the Windows Shell component of Microsoft Windows (including Windows Server 2008 through 2016 and Windows 7 through 10 editions listed in the advisory) mishandles crafted .LNK shortcut files during icon display in Windows Explorer or any other application that parses a shortcut's icon. An attacker who can get a crafted .LNK file in front of a user, or onto a target system for a local user to open, can execute arbitrary code, and no authentication is needed, though the attack requires user interaction such as viewing the file.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:13Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.90026,"percentile":0.99792,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-02-10","dueDate":"2022-08-10","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-8464","provenance":"source"},"vulncheckKev":{"dateAdded":"2017-06-13","exploitedFirstSeen":"2017-06-13","ransomware":false,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2017-Jun","date":"2017-06-13"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2017-06-13"},{"url":"https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/","date":"2020-06-24"},{"url":"https://research.checkpoint.com/2020/rudeminer-blacksquid-and-lucifer-walk-into-a-bar/","date":"2020-09-15"},{"url":"https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf","date":"2021-12-15"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-02-10"},{"url":"https://www.antiy.cn/research/notice&report/research_report/20230310.html","date":"2023-03-10"},{"url":"https://blog.quarkslab.com/how-malware-authors-play-with-the-lnk-file-format.html","date":"2024-05-30"}],"evidenceTotal":8,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/bid/98818","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1038671","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464","tags":["Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/42382/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/42429/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/98818","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1038671","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464","tags":["Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/42382/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/42429/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8464","tags":["US Government Resource"]}],"techniques":[{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: code executes via parsing of shortcut","mappingType":"uncategorized","evidence":[{"from":"description","quote":"allows local users or remote attackers to execute arbitrary code","start":210,"end":274}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1204.001","name":"Malicious Link","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: user opens crafted shortcut file","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"via a crafted .LNK file, which is not properly handled during icon display","start":275,"end":349}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-17414","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-17414","exploited":true,"exploitedSince":"2022-02-10","provenance":"source"},"exploits":[{"id":42382,"url":"https://www.exploit-db.com/exploits/42382","title":"Microsoft Windows - '.LNK' Shortcut File Code Execution (Metasploit)","type":"local","platform":"windows","date":"2017-07-26","verified":false,"provenance":"source"},{"id":42429,"url":"https://www.exploit-db.com/exploits/42429","title":"Microsoft Windows - '.LNK' Shortcut File Code Execution","type":"local","platform":"windows","date":"2017-08-06","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2017-07-26"},"pocGithub":{"count":8,"skipped":1,"earliest":"2016-02-24","earliestUrl":"https://github.com/Elm0D/CVE-2017-8464","repos":[{"name":"3gstudent/CVE-2017-8464-EXP","url":"https://github.com/3gstudent/CVE-2017-8464-EXP","stars":67,"created":"2017-08-02"},{"name":"doudouhala/CVE-2017-8464-exp-generator","url":"https://github.com/doudouhala/CVE-2017-8464-exp-generator","stars":8,"created":"2017-08-07"},{"name":"TrG-1999/DetectPacket-CVE-2017-8464","url":"https://github.com/TrG-1999/DetectPacket-CVE-2017-8464","stars":3,"created":"2022-06-08"},{"name":"Elm0D/CVE-2017-8464","url":"https://github.com/Elm0D/CVE-2017-8464","stars":1,"created":"2016-02-24"},{"name":"xssfile/CVE-2017-8464-EXP","url":"https://github.com/xssfile/CVE-2017-8464-EXP","stars":1,"created":"2018-04-20"}]},"metasploit":[{"name":"LNK Code Execution Vulnerability","module":"exploit/windows/fileformat/cve_2017_8464_lnk_rce","type":"exploit","disclosureDate":"2017-06-13","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/cve_2017_8464_lnk_rce.rb"},{"name":"LNK Code Execution Vulnerability","module":"exploit/windows/local/cve_2017_8464_lnk_lpe","type":"exploit","disclosureDate":"2017-06-13","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb"}],"first":{"date":"2016-02-24","source":"PoC-in-GitHub","url":"https://github.com/Elm0D/CVE-2017-8464"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/42382/","https://www.exploit-db.com/exploits/42429/"],"flow":[{"stage":"exploitation","techniques":["T1204.001"],"provenance":"ai"},{"stage":"related","techniques":["T1203"],"provenance":"source"},{"stage":"related","techniques":["T1204.002"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2016-02-24","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2017-06-13, Exploit-DB 2017-07-26","url":"https://github.com/Elm0D/CVE-2017-8464","provenance":"source"},{"date":"2017-06-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2017-Jun","provenance":"source"},{"date":"2017-06-15","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8464","provenance":"source"},{"date":"2022-02-10","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-02-10","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-17414","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":1701},"priority":{"score":69.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3425 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9979"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 2 Exploit-DB entries; 8 PoC-in-GitHub repos; 2 Metasploit modules"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}