Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2017-0199 | 7.8 | 99.5% | ✅ listed | available | 77.5 (High) |
| CVE-2017-11882 | 7.8 | 100.0% | ✅ listed | available | 75.5 (High) |
| CVE-2019-2215 | 7.8 | 72.1% | ✅ listed | available | 74.83 (High) |
The .lnk zero-day: ZDI-CAN-25373
Trend Micro Zero-Day Initiative has disclosed a new Windows Shell Link zero-day, tracked as ZDI-CAN-25373, that affects the .lnk file format used by the Windows shell to execute arbitrary code when a user opens a crafted shortcut file.
The vulnerability has been actively exploited in the wild since 2017, according to ZDI, and is currently used by 11 state-backed groups spanning North Korea, Iran, Russia, and China. It sits in the same family as CVE-2017-0199 and CVE-2017-11882, which Microsoft has long left unpatched in Office and Windows.
Microsoft declined to ship a patch, citing that the bug does not meet the bar for servicing. That is consistent with the vendor’s pattern on the .lnk and Office RTF zero-days, which have remained unpatched for years despite widespread exploitation.
How the flaw is being exploited
The attack chain starts with a crafted .lnk file delivered to the victim, typically via email or a web download. When the user double-clicks the shortcut, the Windows Shell Link handler processes the file and triggers the zero-day, yielding code execution in the context of the current user.
No additional user interaction is required beyond opening the .lnk. The execution model matches the pattern seen in CVE-2017-0199 and CVE-2017-11882, which Microsoft has left unpatched in Office and Windows for years. Both of those carry a CVSS 7.8 and have been in the wild since 2017, with EPSS scores at 99.5% and 100% respectively, and both are on the CISA KEV list.
Who was hit
The .lnk zero-day is being exploited by 11 state-backed groups: North Korea, Iran, Russia, and China. ZDI says the bug has been in the wild since 2017, which aligns with the CVE-2017-0199 and CVE-2017-11882 pair that Microsoft has left unpatched in Office and Windows for years.
Victors are government entities. The CVEs cover Microsoft Office 2007 SP3 through 2016, plus Windows Vista SP2, Server 2008 SP2, 7 SP1, and 8.1. Both CVEs carry a CVSS 7.8, sit on the CISA KEV list, and have public PoCs. EPSS scores are 99.5% for CVE-2017-0199 and 100% for CVE-2017-11882, putting them in the 100th percentile for exploitation likelihood.
Why Microsoft said no
Microsoft declined to patch the bug, telling ZDI the flaw is "not meeting the bar servicing." That is the vendor’s standard line for the .lnk Shell Link zero-day, which has sat unpatched in Office and Windows since 2017. It is not a standard Office or Windows CVE — it is ZDI-CAN-25373, the new ID for the same family as CVE-2017-0199 and CVE-2017-11882.
The two CVEs are the ones Microsoft has left unpatched for years. Both carry a CVSS 7.8, sit on the CISA KEV list, and have public PoCs. EPSS scores are 99.5% for CVE-2017-0199 and 100% for CVE-2017-11882, putting them in the 100th percentile for exploitation likelihood. The affected products span Microsoft Office 2007 SP3 through 2016, plus Windows Vista SP2, Server 2008 SP2, 7 SP1, and 8.1.
Key points
- Trend Micro ZDI discloses ZDI-CAN-25373, a Windows Shell Link (.lnk) zero-day.
- Exploited in the wild by 11 state-backed groups: North Korea, Iran, Russia, and China.
- Active exploitation dates back to 2017.
- Microsoft declined to patch, citing 'not meeting the bar servicing'.
- Affected products include Windows Vista SP2 through Windows 8.1 and Office 2007 SP3 through Office 2016.
Further reading & sources
- VTPRACTITIONERS{ACRONIS}: Tracking FileFix, Shadow Vector, and SideWinder ~ VirusTotal Blog
- Medium
- SideWinder hackers plant fake Android VPN app in Google Play Store
- 1,000+ Attacks in 2 Years: How the SideWinder APT Sheds Its Skin
- SideWinder APT Attacks Regional Targets in New Campaign - Infosecurity Magazine
- SideWinder APT Targets Nepal, Afghanistan in Wide-Ranging Spy Campaign | Threatpost