CVE-2025-9491

Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability

High7.0EPSS 76.0%

Published: 26 Aug 2025
Updated: 5 Dec 2025
Reserved: 26 Aug 2025
Assigned by: zdi

Description

Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of .LNK files. Crafted data in an .LNK file can cause hazardous content in the file to be invisible to a user who inspects the file via the Windows-provided user interface. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25373.

Scores

CVSS scores of CVE-2025-9491, by who scored it
Scored by	CVSS	Score	Vector
zdiCNA (assigner)	3.0	High7.0	CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA-ADPADP (enrichment)	4.0	Medium4.6	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CISA-ADPADP (enrichment)	3.1	Low3.3	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
NVDNVD · Modified	4.0	Medium4.6	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 76.0% · top 0.5% of all CVEs (5 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.0.

Weakness

CWE-451: User Interface (UI) Misrepresentation of Critical Information (opens in a new tab)All about CWE-451 and its CVEs

Affected products

Microsoft · Windows
- affected 11 Enterprise 23H2 22631.4169 x64

References (3)

ZDI-25-148 (opens in a new tab)x_research-advisory
https://msrc.microsoft.com/update-guide/advisory/ADV25258226 (opens in a new tab)vendor-advisory
https://www.virustotal.com/gui/file/a55789d49c395a9b16cb56b0544266d9ecee409fa3c5fead8082f28c2aff4e76 (opens in a new tab)exploit

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-9491](https://trackcve.app/badge/CVE-2025-9491.svg)](https://trackcve.app/cve/CVE-2025-9491)

Record last updated 5 Dec 2025, 16:28 UTC.