{"id":"CVE-2025-9491","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-9491","generatedAt":"2026-10-28T00:18:24.664Z","title":"Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability.","description":"Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of .LNK files. Crafted data in an .LNK file can cause hazardous content in the file to be invisible to a user who inspects the file via the Windows-provided user interface. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25373.","published":"2025-08-26T17:15:41.000Z","lastModified":"2026-06-17T10:09:06.000Z","status":"Modified","sourceIdentifier":"zdi-disclosures@trendmicro.com","cvss":{"version":"4.0","score":4.6,"severity":"MEDIUM","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-451"],"affected":["microsoft/windows 11 23h2"],"epss":{"score":0.75995,"percentile":0.99526,"date":"2026-10-26","history":[{"date":"2026-10-04","score":0.70862,"percentile":0.99386},{"date":"2026-10-07","score":0.7303,"percentile":0.99445},{"date":"2026-10-25","score":0.74533,"percentile":0.99493},{"date":"2026-10-26","score":0.75995,"percentile":0.99526}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 76.0%, higher than 100% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-148/","tags":["Third Party Advisory"],"source":"zdi-disclosures@trendmicro.com"},{"url":"https://msrc.microsoft.com/update-guide/advisory/ADV25258226","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://www.virustotal.com/gui/file/a55789d49c395a9b16cb56b0544266d9ecee409fa3c5fead8082f28c2aff4e76","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-9491","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}