VulnerabilityModified

CVE-2025-9491

Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability.

MEDIUM 4.6EPSS 68.9%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 68.9%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of .LNK files. Crafted data in an .LNK file can cause hazardous content in the file to be invisible to a user who inspects the file via the Windows-provided user interface. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25373.

CVSS 4.0: 4.6 MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 68.86% probability · 99th percentile
CISA KEV: Not listed
Weakness: CWE-451
Affected: microsoft/windows 11 23h2
Source: zdi-disclosures@trendmicro.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.