CVE-2017-8464

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

The vulnerability CVE-2017-8464 resides in the Windows Shell component of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold/1511/1607/1703, and Windows Server 2016. It is triggered when a crafted .LNK shortcut file is parsed for icon display inside Windows Explorer or any other application that processes shortcut icons, resulting in arbitrary code execution.

An attacker can exploit the flaw either locally or remotely by supplying a malicious .LNK file that is rendered by the victim; successful exploitation grants code execution at the privileges of the user viewing the file. The issue carries a CVSS 3.1 base score of 8.8 with network attack vector, low complexity, and no required privileges or user interaction beyond rendering the icon.

Microsoft published an advisory for CVE-2017-8464 on its security guidance portal, and public proof-of-concept code has been posted to Exploit Database.