CVE-2025-9491

Published Aug 26, 2025

Last updated 14 hours ago

Microsoft Windows

LNK

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-9491 is a vulnerability affecting Microsoft Windows, specifically how it handles .LNK (shortcut) files. This flaw, classified as a User Interface Misrepresentation of Critical Information, allows crafted .LNK files to hide hazardous content from users inspecting the file through the Windows UI. An attacker can exploit this by making malicious elements invisible or misleading. To exploit this vulnerability, a remote attacker needs a user to either visit a malicious page or open a malicious file. Successful exploitation allows the attacker to execute arbitrary code within the context of the current user. This has been leveraged in attacks involving spear-phishing emails containing URLs that lead to malicious LNK files. These files can then execute PowerShell commands to deploy malware, such as the PlugX remote access trojan.

Description: Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of .LNK files. Crafted data in an .LNK file can cause hazardous content in the file to be invisible to a user who inspects the file via the Windows-provided user interface. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25373.
Source: zdi-disclosures@trendmicro.com
NVD status: Modified
Products: windows_11_23h2

Risk scores

CVSS 4.0

Type: Secondary
Base score: 4.6
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: MEDIUM

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

CVSS 3.0

Type: Secondary
Base score: 7
Impact score: 5.9
Exploitability score: 1
Vector string: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

zdi-disclosures@trendmicro.com: CWE-451

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 4

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_23h2:10.0.22631.4169:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "1B2FB7AE-6AE3-463A-BFBC-90A5D1B85869"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.