7.0
Élevée
CVE-2025-9491 Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability
Description
Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of .LNK files. Crafted data in an .LNK file can cause hazardous content in the file to be invisible to a user who inspects the file via the Windows-provided user interface. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25373.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Windows | Versions non publiées |
Références
- ZDI-25-148 www.zerodayinitiative.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Windows
Les 829 CVE de Windows →
CVE-2022-50238
The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended…
7.4
Élevée
CVE-2025-59033
The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy
7.4
Élevée
CVE-2022-40733
An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version…
5.0
Moyenne
CVE-2022-40732
An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version…
5.0
Moyenne