Microsoft closes a 23-year-old vulnerability: goodbye to custom folder icons

Windows closes a 23-year-old vulnerability: custom folder icons no longer supported

Every Patch Tuesday, Microsoft gives us a reason to discuss the latest Windows update that has caused problems. This time, however, the situation is different: a new security update has actually fixed an issue, even if it has disrupted an old feature. When Windows users noticed that their custom folder icons had stopped working, it seemed like another botched Windows update. In reality, however, these missing icons are the result of a deliberate security fix that has been present in Windows for a long time. Microsoft has finally decided that this small feature could no longer be trusted.

Windows stops trusting desktop.ini files

For years, Windows has used a small hidden file called desktop.ini to control the appearance of folders within File Explorer. This file made custom folder icons, localized folder names, and countless icon packs possible. As long as a folder contained the right desktop.ini and the icon resource, Explorer displayed it without a second thought. Unfortunately, it also trusted that metadata in the same way, including files from downloaded archives, WebDAV shares, and other Web-Marked sources.

Every file downloaded from the Internet, Windows attaches a hidden metadata identifier, considering it potentially unsafe. This security feature is called the Mark of the Web (MoTW).

Microsoft has highlighted how threat actors, including the Vietnam-linked OceanLotus group, had abused desktop.ini to disguise malicious folders and make them appear far more trustworthy than they actually were. Attackers exploiting this security bug have historically abused Explorer's willingness to passively accept cosmetic metadata, regardless of how unverified its source was.

That's what the June 2026 security update has changed. Windows now refuses to honor untrusted desktop.ini files. Microsoft has been clear that the disruption of custom folder icons as a consequence of this change was not an unintended regression, but rather a deliberate fix for a security weakness whose roots trace back to a vulnerability first identified in 2003.

A Windows XP-era vulnerability finally comes to an end

This security issue was so old it could buy beer. The story begins in 2003, when Microsoft disclosed and patched a vulnerability tracked as MS03-027. Although the original defect had been fixed, it exposed a broader problem that persisted for decades: Windows Explorer's willingness to trust presentation-related metadata more than it probably should. Hidden within that trust model was an unchecked buffer in the same Shell function responsible for parsing desktop.ini, and it didn't take much to trigger it. Simply navigating to a folder was enough to activate it, without any download prompts, clicks, or files involved. Navigating to that folder was enough. Simply navigating to a folder was enough to activate it, without any download prompts, clicks, or files involved. Navigating to that folder was enough.

There are also other ways to achieve the same result. For example, you can use the attrib +s +h command to hide the desktop.ini file, or you can use the attrib +r command to set the read-only attribute on the folder. Alternatively, you can use a registry editor to modify the Hidden value for the desktop.ini file.

Windows 10

While the loss of custom folder icons may be frustrating for some users, it's important to remember that this change was made to improve Windows' security. By closing a 23-year-old attack surface, Microsoft is taking an important step to protect its users from potential threats. And with the methods described above, advanced users can still customize their folder icons if they wish.