CVE-2017-8464
Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability
Description
CVE-2017-8464 is a HIGH severity remote code execution vulnerability in the Windows Shell component of multiple Microsoft Windows versions, carrying a CVSS 3.1 score of 8.8. The vulnerability allows attackers to execute arbitrary code by crafting a malicious .LNK (shortcut) file. When a user views the folder containing the malicious shortcut file — or connects a removable drive containing one — Windows Shell automatically processes the .LNK file and executes the attacker's payload without additional user interaction beyond navigating to the folder. Affected systems include Windows 7, Windows 8.1, Windows 10 (versions 1511, 1607, 1703), and Windows Server 2008, 2012, and 2016. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of August 10, 2022, and has an EPSS score of 93.88% (99.87th percentile).
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1511 | All versions |
| microsoft | windows 10 1607 | All versions |
| microsoft | windows 10 1703 | All versions |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/98818(Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1038671(Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/42382/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/42429/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8464(US Government Resource)
Weakness Type
LNK File Handling Vulnerability
CVE-2017-8464 does not have a formally assigned CWE in the NVD database, but the underlying weakness is closely related to CWE-20 (Improper Input Validation) in how Windows Shell processes shortcut (.LNK) files. The vulnerability stems from the way the Windows Shell handles specially crafted .LNK files, failing to properly validate the structures and references within the shortcut before attempting to load and display the associated icon.
The Windows Shell automatically processes .LNK files when rendering folder contents, meaning the malicious code executes simply by the user navigating to a directory containing the crafted shortcut. This automatic processing behavior transforms what appears to be a local file parsing issue into a highly effective attack vector, particularly through USB drives and network shares. The vulnerability shares conceptual similarities with the infamous Stuxnet .LNK exploit (CVE-2010-2568), which demonstrated how shortcut file handling flaws can serve as powerful initial access mechanisms.
Impact Analysis
CVE-2017-8464 carries a CVSS 3.1 base score of 8.8 (HIGH) with significant impact across all three security dimensions.
Confidentiality (High): Successful exploitation allows arbitrary code execution in the context of the current user. If the user has administrative privileges, the attacker gains full access to all data on the system, including credentials, documents, email archives, and any network resources accessible to the user. Even with standard user privileges, the attacker can access all files and data owned by that user.
Integrity (High): Code execution enables the attacker to modify system files, install persistent malware, alter security configurations, create new user accounts, and tamper with system logs to cover their tracks. The attacker can install rootkits or backdoors that survive system reboots.
Availability (High): The attacker can crash the system, encrypt files for ransomware attacks, disable security software, or render the machine inoperable. The exploitation can also be used as a springboard for denial-of-service attacks against other network resources.
User interaction required: The CVSS vector indicates that user interaction is required (UI:R) — specifically, the user must navigate to a folder containing the malicious .LNK file or connect a removable drive. However, this is a very low bar since Windows automatically processes shortcut files upon folder access.
With an EPSS score of 93.88% (99.87th percentile), exploitation of this vulnerability is near-certain in exposed environments.
Exploit Maturity
CVE-2017-8464 has a very high exploit maturity with multiple public exploits available and confirmed active exploitation.
Public exploits: Multiple exploit modules are available on Exploit-DB (IDs 42382 and 42429), providing ready-to-use code for crafting malicious .LNK files. The Metasploit framework also includes modules targeting this vulnerability.
KEV listing: CISA added CVE-2017-8464 to the Known Exploited Vulnerabilities catalog on February 10, 2022, confirming active in-the-wild exploitation. The federal remediation deadline was August 10, 2022.
Ransomware association: CISA's KEV catalog does not indicate a direct ransomware association. However, .LNK-based exploits are a common initial access vector used in various malware campaigns, including ransomware delivery through USB drives and phishing attachments.
Historical context: This vulnerability is reminiscent of CVE-2010-2568, the .LNK vulnerability famously exploited by the Stuxnet worm targeting industrial control systems. The pattern of exploiting Windows shortcut file handling continues to be an attractive attack vector due to the automatic processing behavior of Windows Shell.
Attack surface: The vulnerability is particularly dangerous in environments with removable media use, shared network folders, or webDAV shares, where malicious .LNK files can be planted for mass exploitation.
Remediation
-
Apply Microsoft security update MS17-013 immediately. Install the official patch from the Microsoft Security Response Center for all affected Windows versions. This update corrects how Windows Shell validates .LNK files.
-
Disable AutoPlay and AutoRun for removable media. Configure Group Policy to prevent automatic execution of content from USB drives and other removable media. This reduces the risk of exploitation through infected removable storage devices.
-
Restrict .LNK file rendering on network shares. Where possible, configure permissions on network shares and WebDAV servers to prevent the automatic display of .LNK files from untrusted sources. Consider blocking .LNK files at email gateways.
-
Implement application whitelisting. Deploy Windows Defender Application Control (WDAC) or AppLocker policies to restrict executable code to approved applications, limiting the impact of successful exploitation.
-
Monitor for malicious .LNK files. Configure endpoint detection tools to alert on suspicious .LNK file creation, particularly in shared folders, temporary directories, and removable media mount points. Look for .LNK files with unusual target paths or embedded commands.
-
Enforce least privilege. Ensure users operate with standard (non-administrative) privileges to limit the impact of exploitation. Implement privileged access management for administrative tasks.
Technical Details
CVE-2017-8464 is a remote code execution vulnerability in the Windows Shell component responsible for processing .LNK shortcut files. The vulnerability exists because Windows Shell improperly handles the parsing of specially crafted shortcut files.
Attack vector and prerequisites: The attack can be delivered over the network (AV:N) via shared folders, WebDAV shares, or removable media. The complexity is low (AC:L) but requires user interaction (UI:R) — the victim must navigate to a folder containing the malicious .LNK file. No privileges are required (PR:N) on the attacker's side.
Exploitation mechanism: A malicious .LNK file is crafted to reference a specially prepared DLL or CPL file. When Windows Explorer renders the folder containing the .LNK file, it attempts to load the referenced icon resource, which triggers the execution of attacker-controlled code. The key aspect is that Windows processes .LNK files automatically during folder rendering — the user does not need to click or open the shortcut file.
Delivery methods: The exploit can be delivered via USB drives (auto-processing when the drive is opened in Explorer), network shares (users browsing to a share containing the malicious file), WebDAV shares accessible over HTTP, or email attachments containing archives with .LNK files.
Affected platforms: Windows 7, Windows 8.1, Windows RT 8.1, Windows 10 (versions 1511, 1607, 1703), Windows Server 2008 (including R2), Windows Server 2012 (including R2), and Windows Server 2016.
Frequently Asked Questions
What is CVE-2017-8464?
CVE-2017-8464 is a high-severity remote code execution vulnerability in the Windows Shell component that handles .LNK shortcut files. An attacker can craft a malicious .LNK file that executes arbitrary code when a user simply navigates to the folder containing it. The vulnerability carries a CVSS score of 8.8 and affects Windows 7 through Windows 10 and corresponding Server editions.
How does CVE-2017-8464 get exploited?
The attacker creates a specially crafted .LNK shortcut file and places it in a location where victims will encounter it — such as a USB drive, network share, or WebDAV folder. When the victim opens the containing folder in Windows Explorer, the OS automatically processes the .LNK file to render its icon, triggering the execution of the attacker's malicious payload without requiring the user to click the shortcut.
How do I fix CVE-2017-8464?
Apply the Microsoft security update available through the MSRC advisory for CVE-2017-8464. Additionally, disable AutoPlay for removable media, restrict .LNK file processing from untrusted network locations, and deploy endpoint detection to identify malicious shortcut files. Ensure all affected Windows versions in your environment receive the patch.
How severe is CVE-2017-8464?
CVE-2017-8464 is rated HIGH with a CVSS score of 8.8. Its EPSS score of 93.88% places it in the 99.87th percentile for exploitation likelihood. CISA confirmed active exploitation by listing it in the KEV catalog. Multiple public exploits exist, and the low user interaction barrier makes it particularly dangerous in environments with shared folders or removable media usage.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.