Microsoft Silently Patches Windows LNK Flaw After Years of Active Exploitation
Summary: Microsoft quietly fixed CVE-2025-9491, a Windows LNK file UI misinterpretation flaw rated 7.8/7.0, in its November 2025 Patch Tuesday updates, according to ACROS Security's 0patch. The flaw, disclosed by Trend Micro's Zero Day Initiative in March 2025 as ZDI-CAN-25373, had been exploited since 2017 by 11 state-sponsored groups from China, Iran, North Korea, and Russia, and hides malicious commands from the Properties dialog by using whitespace characters or by truncating the Target field at 260 characters while the file can hold up to 32k.
What's compelling: Eleven state-sponsored groups from four countries used this flaw for eight years while Microsoft argued it did not meet the bar for immediate servicing, so the exposure window was measured in years, not patch cycles.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-9491
- Related