Two Windows vulnerabilities, one a 0
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-9491 | LNK File UI Misrepresentation RCE in Microsoft Windows CVE-2025-9491 is a user-interface misrepresentation flaw (CWE-451) in Microsoft Windows' handling of .LNK shortcut files: crafted data in an .LNK file can make hazardous content invisible when a user inspects the file through the Windows-provided UI. Exploitation requires user interaction — the target must visit a malicious page or open a malicious file — after which the disguised shortcut causes code execution. A successful attack lets the attacker run arbitrary code in the context of the current user, with no privilege escalation indicated (CVSS 4.0 base score 4.6, local attack vector). The CPE data lists Windows 11 23H2 as the affected product, though the advisory text describes Microsoft Windows generally; no affected build numbers are provided. Exploitation is not hypothetical: reporting indicates Microsoft silently patched the flaw after years of active exploitation, APT groups continue leveraging it, EPSS assigns a 68.9% probability of exploitation within 30 days (99th percentile), and it is not yet in CISA KEV. Do: Ensure Windows endpoints are fully patched with the Microsoft update that fixes .LNK file rendering — verify fleet-wide build levels through Windows Update or your patch-management tooling, since the fix was reportedly shipped silently. Until patched, treat .LNK files arriving via email, web downloads, or removable USB media with suspicion and do not rely on visual inspection of shortcut properties as a safety check. Given reported APT abuse, prioritize detection of malicious .LNK delivery in targeted sectors (government, power) named in current threat reporting. | 4.6 | 69% |
| mass≈100M+ devices (Windows 11 23H2 is one of the most widely deployed Windows 11 releases) |
Full article314 words · extracted from arstechnica.com · click to collapse
Two Windows vulnerabilities—one a zero-day that has been known to attackers since 2017 and the other a critical flaw that Microsoft initially tried and failed to patch recently—are under active exploitation in widespread attacks targeting a swath of the Internet, researchers say.
The zero-day went undiscovered until March, when security firm Trend Micro said it had been under active exploitation since 2017, by as many as 11 separate advanced persistent threats (APTs). These APT groups, often with ties to nation-states, relentlessly attack specific individuals or groups of interest. Trend Micro went on to say that the groups were exploiting the vulnerability, then tracked as ZDI-CAN-25373, to install various known post-exploitation payloads on infrastructure located in nearly 60 countries, with the US, Canada, Russia, and Korea being the most common.
A large-scale, coordinated operation
Seven months later, Microsoft still hasn’t patched the vulnerability, which stems from a bug in the Windows Shortcut binary format. The Windows component makes opening apps or accessing files easier and faster by allowing a single binary file to invoke them without having to navigate to their locations. In recent months, the ZDI-CAN-25373 tracking designation has been changed to CVE-2025-9491.
On Thursday, security firm Arctic Wolf reported that it observed a China-aligned threat group, tracked as UNC-6384, exploiting CVE-2025-9491 in attacks against various European nations. The final payload is a widely used remote access trojan known as PlugX. To better conceal the malware, the exploit keeps the binary file encrypted in the RC4 format until the final step in the attack.
“The breadth of targeting across multiple European nations within a condensed timeframe suggests either a large-scale coordinated intelligence collection operation or deployment of multiple parallel operational teams with shared tooling but independent targeting,” Arctic Wolf said. “The consistency in tradecraft across disparate targets indicates centralized tool development and operational security standards even if execution is distributed across multiple teams.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://arstechnica.com/security/2025/10/two-windows-vulnerabilities-one-a-0-day-are-under-active-exploitation/