Microsoft Silently Mitigated Exploited LNK Vulnerability

Microsoft has quietly mitigated an exploited LNK vulnerability with its November 2025 security updates, Acros Security says. Tracked as CVE-2025-9491 (CVSS score 7.0), the flaw had allowed threat actors to hide malicious code in LNK files by concealing the command text from users in the file’s properties view. The bug was disclosed in March by Trend Micro’s Zero Day Initiative (ZDI), which warned that nearly a dozen threat actors had been exploiting it for years; exploitation was still ongoing in October. Exploitation relied on users manually executing the shortcut, with attackers disguising LNKs as harmless documents.

According to Acros Security, Microsoft’s patch now causes Windows to display the entire string in the Target field of a shortcut’s properties tab, reducing the risk of hidden payloads. prior guidance from Microsoft noted that existing protections and user interaction to open LNK files mitigated the threat, and Microsoft had indicated the issue might be addressed in a feature release rather than an immediate security update.