Microsoft Silently Patches Windows LNK Flaw After Years of Active Exploitation

According to ACROS Security's 0patch, Microsoft has silently patched a Windows LNK flaw, CVE-2025-9491, that has been exploited by several threat actors since 2017 as part of Patch Tuesday updates in November 2025. The vulnerability is described as a Windows Shortcut (LNK) file UI misinterpretation that could allow remote code execution when a user views or interacts with crafted LNK files, with the NVD noting that an attacker can run code in the context of the current user.

First details emerged in March 2025, when ZDI disclosed that the issue had been exploited by 11 state-sponsored groups from China, Iran, North Korea and Russia for data theft, espionage and financially motivated campaigns. Microsoft had previously indicated the flaw did not warrant immediate servicing, but a late October 2025 update prompted a formal advisory and a patch in November 2025, with 0patch explaining that the fix makes the Properties dialog show the entire Target command, regardless of length. 0patch’s micropatch, by contrast, provides a warning when opening long LNK Target strings.