What file types have a vulnerability to hide and run a exe file upon opening?

And before everyone goes "OMG h4xxor!!! Hide the children!!!!" I'm not asking how, I'm just asking what files type are vulnerable.


2 Answers 2


There is no general answer. First, this obviously depends on your operating system. I presume you are asking about MS Windows, but there are still many variants.

But more importantly, it depends on system setup. It's not the files that are vulnerable, the problem is a system configuration that opens certain files with vulnerable programs (i.e. programs that support the launching of an exe inside a file). So it depends on what software is installed and configured to be used for opening files (i.e. is the default handler for an extension/file type).

In addition to that, there were some vulnerabilites where the OS itself was vulnerable to an attack when opening a file (e.g. the recent .LNK bug). There are independent of the app used to open a file, but they are security bugs and (supposed to be) fixed immediately on discovery.

So your question as asked does not have a meaningful answer. Maybe you could explain what you are looking for?

  • (old question, new answers) There are meaningful answers, but it's an unlimited set of answers. (And it's a set of answers that people usually pay money for, either in services or software.) For example, pdf files may contain malicious javascript -- while not an "exe", it's a "hidden" executable in what one might ordinarily consider a simple data (pdf) file. (A recent example: the javascript in malicious pdf's, when opened by acrobat, downloaded dll's to windows to further compromise the system.)
    – michael
    Apr 14, 2013 at 0:09

If your question is, what file types can contain executable code you might have a look at the list of file types blocked by Outlook. Note that this list is far from complete, e.g. if you changed your security settings, Microsoft Office might also execute arbitrary code when opening Office documents.

Attachment file types blocked by Outlook

  • Blocking the attachments would only block sending nasties from outlook, does it also block incoming file types that are blocked?
    – user38008
    Aug 27, 2010 at 12:41
  • @user38008: I didn't mean to block the attachments. The list just gives you an overview of filetypes containing executable code.
    – 0xA3
    Sep 23, 2010 at 9:31
  • Any "filetype" can contain executable code. For example, command: rm -fr myfile (Q.E.D.) Thus, s.o. comments should be blocked by Outlook, too.
    – michael
    Apr 14, 2013 at 0:21
  • e.g., eval $( wget -q -O - http://superuser.com/questions/181361/what-files-can-hide-an-exe-and-run-it-when-they-are-opened | sed -n 's/.*command:\(.*\).Q.E.D.*/\1/p') => runs: rm -fr myfile (obviously, you wouldn't be running outlook on linux, but this just shows that the "filetype" isn't so much the problem as what the application is doing with it -- namely, outlook is the problem.)
    – michael
    Apr 14, 2013 at 0:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.