Microsoft Windows LNK Vulnerability Exploited by Hackers in the Wild as a 0-Day

Microsoft has silently patched a Windows shortcut vulnerability that threat actors exploited for nearly a decade to hide malicious commands from users.

The vulnerability, tracked as CVE-2025-9491, affected how Windows displays the contents of LNK shortcut files, allowing attackers to conceal harmful payloads beyond what users could see in file properties.

Technical Details

The core issue resided in Windows Explorer’s Properties dialog for LNK files. While the Windows shortcut structure supports target commands up to 32,000 characters, the user interface displayed only the first 260 characters.

Attackers exploited this limitation by padding the beginning of commands with whitespace characters (spaces, tabs, or other invisible symbols) to push malicious code beyond the visible threshold.

CVE-2025-9491 allows attackers to create shortcuts that appear harmless when inspected but execute full malicious payloads when double-clicked.

For example, a shortcut might show only conhost.exe followed by hundreds of spaces, while hidden commands like calc.exe or PowerShell scripts remained invisible even when scrolling through the Target field.

March 18, 2025: Trend Micro researchers Peter Girnus and Aliakbar Zahravi published findings on nearly 1,000 malicious shortcuts used in APT campaigns since 2017. Microsoft reviewed the report and initially declined to patch, stating the issue did not meet their servicing criteria.

Late October 2025: Arctic Wolf discovered Chinese-affiliated threat actor UNC6384 actively exploiting the vulnerability in targeted attacks against Hungarian and Belgian diplomatic entities. This renewed pressure on Microsoft to address the issue.

November 2025: Microsoft silently delivered a fix through Windows Updates without publishing a security advisory. The patch modified the Properties dialog to display the entire command string, regardless of length, though the single-line field still requires horizontal scrolling for long commands.

Alternative Patching Approach

Third-party security vendor 0patch developed an alternative solution that takes a more restrictive approach.

Their micropatch truncates LNK targets longer than 260 characters when launched through Windows Explorer and displays a security warning to users.

This strategy assumes legitimate user-created shortcuts rarely exceed the 260-character limit, while blocking the 1,000+ malicious shortcuts identified in the wild.

0patch’s solution addresses scenarios where simply displaying the full command might not prevent execution, as many users may still proceed despite warnings.

The micropatch is available for multiple Windows versions, including legacy systems no longer receiving official Microsoft updates.

The vulnerability highlights ongoing challenges in balancing security with backward compatibility, particularly for UI components that have remained largely unchanged for decades.

Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates