HIGH

CVE-2025-9491

CVSS v3

7.8

HIGH

EPSS Score

68.9 %

exploit probability, as of 2026-09-25

CISA KEV

known exploited

Exploitation

—

SSVC status

Description

Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of .LNK files. Crafted data in an .LNK file can cause hazardous content in the file to be invisible to a user who inspects the file via the Windows-provided user interface. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25373.

Technical details

Published: 2025-08-26

Frequently asked questions

What is CVE-2025-9491?

Is CVE-2025-9491 actively exploited?

Active exploitation of CVE-2025-9491 has not been confirmed. Its EPSS score was 68.9% on 2026-09-25, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2025-9491?

CVE-2025-9491 has a CVSS v3 base score of 7.8 (HIGH severity).

Is CVE-2025-9491 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IP Search CVEs SIEM & TIP integrations

No credit card required · 500 free checks/month · Free API key

Other 2025 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database