Improper input validation in Microsoft Windows and Windows Server - CVE-2018-8345
Published: August 14, 2018 / Updated: August 14, 2018
Vulnerability identifier: #VU14379
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-8345
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to an error when processing .LNK files (windows shortcuts). A remote attacker can place a specially crafted .LNK file along with associated malicious binary and automatically execute it when the victim opens a removable drive or a remote share that contains .LNK file.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Affected software
Microsoft Windows
Windows Server
Windows Server
How to mitigate CVE-2018-8345
Install updates from vendor's website.