Internet Shortcut Files Security Feature Bypass Vulnerability

Summary

This vulnerability affects Microsoft Windows, where internet shortcut files can be crafted to bypass built-in security protections. Successful exploitation could allow an attacker to evade security warnings and run untrusted content on the affected system.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Timeline

1. Feb 13, 2024Added to CISA KEV

   CISA has evidence of exploitation in the wild

2. Feb 13, 2024, 6:02 PM UTCCVE published
3. Mar 5, 2024CISA remediation deadline

   Due date for US federal agencies to patch

4. Aug 10, 2026, 5:53 PM UTCRecord last updated
5. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Microsoft Windows 10 Version 1809

  From 10.0.0 · fixed in 10.0.17763.5458

• Microsoft Windows 10 Version 1809

  From 10.0.17763.0 · fixed in 10.0.17763.5458

• Microsoft Windows 10 Version 21H2

  From 10.0.19043.0 · fixed in 10.0.19044.4046

• Microsoft Windows 10 Version 22H2

  From 10.0.19045.0 · fixed in 10.0.19045.4046

• Microsoft Windows 11 version 21H2

  From 10.0.0 · fixed in 10.0.22000.2777

• Microsoft Windows 11 version 22H2

  From 10.0.22621.0 · fixed in 10.0.22621.3155

• Microsoft Windows 11 version 22H3

  From 10.0.22631.0 · fixed in 10.0.22631.3155

• Microsoft Windows 11 Version 23H2

  From 10.0.22631.0 · fixed in 10.0.22631.3155

• Microsoft Windows Server 2019

  From 10.0.17763.0 · fixed in 10.0.17763.5458

• Microsoft Windows Server 2019 (Server Core installation)

  From 10.0.17763.0 · fixed in 10.0.17763.5458

• Microsoft Windows Server 2022

  From 10.0.20348.0 · fixed in 10.0.20348.2322

• Microsoft Windows Server 2022, 23H2 Edition (Server Core installation)

  From 10.0.25398.0 · fixed in 10.0.25398.709

References 1