Product:
Windows Shell
Summary
Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows local users or remote attackers to execute arbitrary code via a crafted .LNK file. This vulnerability occurs due to improper handling of the file during icon display in Windows Explorer or any application that parses the icon of the shortcut.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2017-8464 |
Exploitation
To exploit this vulnerability, an attacker must create a malicious .LNK file and host it on a network share or send it to a victim. When the victim interacts with the .LNK file, the crafted code is executed, allowing the attacker to gain control over the affected system. User interaction is required for the exploitation to succeed, as the victim must open or preview the malicious shortcut.
Affected Products
- Windows Server 2008 SP2 and R2 SP1
- Windows 7 SP1
- Windows 8
- Windows 8.1
- Windows Server 2012 Gold and R2
- Windows RT 8.1
- Windows 10 Gold, 1511, 1607, 1703
- Windows Server 2016
Mitigation
To mitigate this vulnerability, users should apply updates as per the vendor’s instructions. Keeping systems updated will help protect against potential exploitation of this vulnerability.