CVE-2025-9491: Windows LNK file UI misrepresentation enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityCVSS 4.0 rates it medium (4.6) and it requires user interaction, but the high EPSS score and code execution outcome keep it worth prompt patching and monitoring.

What it is

A flaw in how Windows renders .LNK shortcut files lets crafted data hide hazardous content from a user inspecting the file through the Windows UI. Because the user sees a benign-looking shortcut, they may open it and trigger code execution. It matters because the disguise defeats the normal visual check users rely on before opening shortcuts.

Impact

An attacker can execute arbitrary code in the context of the current user, giving them the same access and privileges as the victim. The CVSS 4.0 vector shows low integrity impact and no direct confidentiality or availability impact, so the main gain is code execution under the user's account.

Attack surface

Reached locally by opening a malicious .LNK file or visiting a malicious page, per the description. No privileges are required (PR:N), but user interaction is required (UI:A) because the target must open the file or visit the page.

Exploitation

Not listed in CISA KEV and no ransomware group use is documented. EPSS is high (0.68864, 99.3rd percentile), but the references carry only a Third Party Advisory tag and no public exploit tag, so exploitation is not confirmed by this record.

What to do

• Apply the Microsoft update or advisory guidance referenced in ADV25258226 as soon as it is available for your Windows builds.
• Treat .LNK files from email, downloads and removable media as untrusted; block or quarantine them at the gateway and endpoint.
• Disable or restrict execution of .LNK files from untrusted locations using Windows policies where operationally possible.
• Train users not to open shortcuts from unexpected sources, since the UI can misrepresent the file contents.
• Monitor for .LNK files arriving from external sources and review them before allowing execution.

Detection

• Alert on .LNK file creation or execution from email attachment, download or temp directories.
• Hunt for processes spawned by explorer.exe or other shell processes opening .LNK files from user-writable paths.
• Inspect .LNK files for hidden or oversized data streams that do not match the visible shortcut target.
• Correlate .LNK execution with subsequent child process creation, especially scripting or command interpreters.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.