SB2025031863 - Remote code execution via misrepresented LNK file in Microsoft Windows

Description

This security bulletin contains information about 1 vulnerability.

1) Spoofing attack (CVE-ID: CVE-2025-9491)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data in .lnk files. A remote attacker can hide command line arguments inside an .lnk file, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Note, the vulnerability is being actively exploited in the wild.

Remediation

Install update from vendor's website.

References

• https://www.zerodayinitiative.com/advisories/ZDI-25-148/
• https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html
• https://msrc.microsoft.com/update-guide/advisory/ADV25258226
• https://blog.0patch.com/2025/12/microsoft-silently-patched-cve-2025.html