CVE-2025-9491CWE-451

Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability

High · published August 26, 2025

Patch now

High probability of exploitation

CVSS calls it high at 7.0. It sits in the 99.5th percentile for exploit probability.

CVSS v3.0
7.0
EPSS
73%
Percentile
99.5
In the wild
Unconfirmed
What it is

Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of .LNK files. Crafted data in an .LNK file can cause hazardous content in the file to be invisible to a user who inspects the file via the Windows-provided user interface. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25373.

The record
Technical detail
CVSS v3.0
7.0 · HIGH
Vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.73030 · 99.5th percentile
Weakness
CWE-451 · User Interface (UI) Misrepresentation of Critical Information
Published
2025-08-26T16:25Z
EPSS history
Timeline
  • 26 AUG 16:25Z
    Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability
    cvelistv5