KEVIntel
Back to KEVs
8.8
CVSS
High

CVE-2017-8464

PUBLISHED

Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT...

Exploited in the wild Remote Low complexity
Vendor
Microsoft Corporation
Product
Windows Shell
Published
Jun 15, 2017
EPSS
—

Description

Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows local users or remote attackers to execute arbitrary code via a crafted .LNK file, which is not properly handled during icon display in Windows Explorer or any other application that parses the icon of the shortcut. aka "LNK Remote Code Execution Vulnerability."

windows cisa metasploit microsoft

CVSS scores

CVSS v3.1 8.8 High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0 9.3

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitation status

Exploited in the wild

Recorded 2022-02-10 00:00:00 UTC · Source

SSVC decision points

Exploitation
active
Automatable
No
Technical impact
total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source Added
CISA Feb 10, 2022

Scanner integrations

Scanner Reference Detected
Metasploit https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb Apr 29, 2025

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

cve_2017_8464_lnk_lpe

metasploit · Created Unknown

Metasploit module for CVE-2017-8464

cve_2017_8464_lnk_rce

metasploit · Created Unknown

Metasploit module for CVE-2017-8464

TieuLong21Prosper/Detect-CVE-2017-8464

github · Created 2023-11-27 10:28:47 UTC · 0 stars

- using python to detect cve-2017-8464 vulnerbilities

tuankiethkt020/Phat-hien-CVE-2017-8464

github · Created 2023-05-01 14:59:04 UTC · 0 stars

TrG-1999/DetectPacket-CVE-2017-8464

github · Created 2022-06-08 01:39:48 UTC · 2 stars

Exploit vulnerabilities and vulnerability prevention implementation

xssfile/CVE-2017-8464-EXP

github · Created 2018-04-20 09:01:03 UTC · 1 stars

doudouhala/CVE-2017-8464-exp-generator

github · Created 2017-08-07 11:56:11 UTC · 8 stars

this tool can generate a exp for cve-2017-8486, it is developed by python

3gstudent/CVE-2017-8464-EXP

github · Created 2017-08-02 02:14:37 UTC · 66 stars

Support x86 and x64

Elm0D/CVE-2017-8464

github · Created 2016-02-24 17:36:29 UTC · 1 stars

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel

  • Detected by Metasploit