Windows Shell
by Microsoft
CVEs (42)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-43552 | Hig | 0.48 | 7.3 | 0.01 | Oct 8, 2024 | Windows Shell Remote Code Execution Vulnerability | ||
| CVE-2025-62565 | Hig | 0.47 | 7.3 | 0.01 | Dec 9, 2025 | Use after free in Windows Shell allows an authorized attacker to elevate privileges locally. | ||
| CVE-2026-69606 | Hig | 0.46 | 7.0 | 0.00 | Sep 8, 2026 | Use after free in Windows Shell allows an authorized attacker to elevate privileges locally. | ||
| CVE-2026-69383 | Hig | 0.46 | 7.0 | 0.00 | Sep 8, 2026 | External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally. | ||
| CVE-2026-26166 | Hig | 0.46 | 7.0 | 0.00 | Apr 14, 2026 | Double free in Windows Shell allows an authorized attacker to elevate privileges locally. | ||
| CVE-2026-26165 | Hig | 0.46 | 7.0 | 0.00 | Apr 14, 2026 | Use after free in Windows Shell allows an authorized attacker to elevate privileges locally. | ||
| CVE-2026-42907 | Med | 0.42 | 6.5 | 0.01 | Jun 9, 2026 | Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information locally. | ||
| CVE-2026-32151 | Med | 0.42 | 6.5 | 0.01 | Apr 14, 2026 | Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information over a network. | ||
| CVE-2026-20847 | Med | 0.42 | 6.5 | 0.01 | Jan 13, 2026 | Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to perform spoofing over a network. | ||
| CVE-2019-1053 | Med | 0.41 | 6.3 | 0.01 | Jun 12, 2019 | An elevation of privilege vulnerability exists when the Windows Shell fails to validate folder shortcuts. An attacker who successfully exploited the vulnerability could elevate privileges by escaping a sandbox. To exploit this vulnerability, an attacker would require… | ||
| CVE-2026-42906 | Med | 0.36 | 5.5 | 0.00 | Jun 9, 2026 | Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information locally. | ||
| CVE-2025-47160 | Med | 0.35 | 5.4 | 0.01 | Jun 10, 2025 | Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. | ||
| CVE-2026-20834 | Med | 0.30 | 4.6 | 0.01 | Jan 13, 2026 | Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack. | ||
| CVE-2010-3970 | 0.08 | — | 0.68 | Dec 22, 2010 | Stack-based buffer overflow in the CreateSizedDIBSECTION function in shimgvw.dll in the Windows Shell graphics processor (aka graphics rendering engine) in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2 allows remote attackers… | |||
| CVE-2005-0063 | 0.07 | — | 0.48 | May 2, 2005 | The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as… | |||
| CVE-2005-2118 | 0.04 | — | 0.48 | Oct 21, 2005 | Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote user-assisted attackers to execute arbitrary commands via a crafted shortcut (.lnk) file with long font properties that lead to a buffer overflow when the user views the file's properties… | |||
| CVE-2005-2122 | 0.04 | — | 0.46 | Oct 21, 2005 | Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to execute arbitrary commands via a shortcut (.lnk) file with long font properties that lead to a buffer overflow in the Client/Server Runtime Server Subsystem (CSRSS), a… | |||
| CVE-2004-0420 | 0.04 | — | 0.46 | Jul 7, 2004 | The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet… | |||
| CVE-2015-2548 | 0.02 | — | 0.25 | Oct 14, 2015 | Use-after-free vulnerability in the Tablet Input Band in Windows Shell in Microsoft Windows Vista SP2 and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka "Microsoft Tablet Input Band Use After Free Vulnerability." | |||
| CVE-2015-2515 | 0.02 | — | 0.29 | Oct 14, 2015 | Use-after-free vulnerability in Windows Shell in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via… |
- risk 0.48cvss 7.3epss 0.01
Windows Shell Remote Code Execution Vulnerability
- risk 0.47cvss 7.3epss 0.01
Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.
- risk 0.46cvss 7.0epss 0.00
Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.
- risk 0.46cvss 7.0epss 0.00
External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally.
- risk 0.46cvss 7.0epss 0.00
Double free in Windows Shell allows an authorized attacker to elevate privileges locally.
- risk 0.46cvss 7.0epss 0.00
Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.
- risk 0.42cvss 6.5epss 0.01
Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information locally.
- risk 0.42cvss 6.5epss 0.01
Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information over a network.
- risk 0.42cvss 6.5epss 0.01
Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to perform spoofing over a network.
- risk 0.41cvss 6.3epss 0.01
An elevation of privilege vulnerability exists when the Windows Shell fails to validate folder shortcuts. An attacker who successfully exploited the vulnerability could elevate privileges by escaping a sandbox. To exploit this vulnerability, an attacker would require…
- risk 0.36cvss 5.5epss 0.00
Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information locally.
- risk 0.35cvss 5.4epss 0.01
Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
- risk 0.30cvss 4.6epss 0.01
Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack.
- CVE-2010-3970Dec 22, 2010risk 0.08cvss —epss 0.68
Stack-based buffer overflow in the CreateSizedDIBSECTION function in shimgvw.dll in the Windows Shell graphics processor (aka graphics rendering engine) in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2 allows remote attackers…
- CVE-2005-0063May 2, 2005risk 0.07cvss —epss 0.48
The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as…
- CVE-2005-2118Oct 21, 2005risk 0.04cvss —epss 0.48
Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote user-assisted attackers to execute arbitrary commands via a crafted shortcut (.lnk) file with long font properties that lead to a buffer overflow when the user views the file's properties…
- CVE-2005-2122Oct 21, 2005risk 0.04cvss —epss 0.46
Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to execute arbitrary commands via a shortcut (.lnk) file with long font properties that lead to a buffer overflow in the Client/Server Runtime Server Subsystem (CSRSS), a…
- CVE-2004-0420Jul 7, 2004risk 0.04cvss —epss 0.46
The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet…
- CVE-2015-2548Oct 14, 2015risk 0.02cvss —epss 0.25
Use-after-free vulnerability in the Tablet Input Band in Windows Shell in Microsoft Windows Vista SP2 and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka "Microsoft Tablet Input Band Use After Free Vulnerability."
- CVE-2015-2515Oct 14, 2015risk 0.02cvss —epss 0.29
Use-after-free vulnerability in Windows Shell in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via…
Page 2 of 3