Vulnerability · Published Aug 26, 2025 · Assigned by zdi

CVE-2025-9491Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability

Low 3.3

In plain English

A low-severity security flaw in Windows from Microsoft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 76.0% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)3.3Low

Exploit odds (30 days)76.0%top 0.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of .LNK files. Crafted data in an .LNK file can cause hazardous content in the file to be invisible to a user who inspects the file via the Windows-provided user interface. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25373.

Affected products (as reported)

Vendor	Product	Versions
Microsoft	Windows	11 Enterprise 23H2 22631.4169 x64

Weakness: CWE-451 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

ZDI-25-148 x_research-advisory
https://msrc.microsoft.com/update-guide/advisory/ADV25258226 vendor-advisory
https://www.virustotal.com/gui/file/a55789d49c395a9b16cb56b0544266d9ecee409fa3c5fead8082f28c2aff4e76 exploit