CVE-2017-8464

A Windows shortcut file can be made to trigger malicious software when Windows displays its icon. It is like a package label that causes a hidden intruder to enter when someone merely looks at it, potentially giving the intruder control of the computer.

This matters to you if you run Microsoft Windows on business computers or servers, especially the older releases listed in the advisory. It is a risk when users or systems can receive, open, or browse untrusted shortcut files.

Attackers are already exploiting this vulnerability in real-world attacks, and public exploit code is available. Treat this as a red-priority remediation: identify affected Windows devices and update them without delay.

Confirm exposure by inventorying Windows endpoints and servers against the affected releases, then check installed update history against Microsoft’s CVE-2017-8464 advisory. Apply the Microsoft update applicable to each supported Windows branch; the supplied findings do not provide fixed build numbers, so use the vendor advisory to select the correct update rather than assuming a single version covers all systems.

If patching is delayed, prevent shortcut files from untrusted email attachments, downloads, network shares, and removable media from reaching affected devices, and restrict users from opening or browsing those locations. CISA added this issue to its Known Exploited Vulnerabilities catalog and set a remediation due date of 2022-08-10; that date is historical, but indicates the issue warranted mandated remediation. Monitor affected devices for newly created or opened .LNK files, unexpected process launches associated with shortcut handling, and signs of unauthorized access or ransomware.

Severity is CVSS 8.8 (High): AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is an arbitrary-code-execution issue caused by improper handling of crafted .LNK shortcut icons by Windows Shell, including Windows Explorer and other icon-parsing applications. CISA KEV lists CVE-2017-8464 as confirmed exploited in the wild, added 2022-02-10, and two public exploits are known. EPSS is 89.9% at the 100th percentile with a flat trend, but confirmed exploitation is the stronger signal.