Table of Contents
Why Did Microsoft Quietly Patch CVE-2025-9491 After Refusing Initially?
You need to be aware of a critical shift in how Microsoft handles the LNK file vulnerability tracked as CVE-2025-9491. Since late August 2025, security professionals have monitored this flaw, which allows for Remote Code Execution (RCE) on Windows systems.
The core issue lies in how Windows shortcuts (.LNK files) display information. Attackers can manipulate these files to hide malicious command-line arguments. When you inspect a compromised shortcut through the standard Windows interface, the dangerous code remains invisible. This deception tricks users into executing malware under their own credentials, bypassing standard visual checks.
Microsoft’s Initial Refusal and Subsequent Pivot
The handling of this vulnerability followed an unusual trajectory. Initially, the Zero Day Initiative (ZDI) and Trend Micro assessed the flaw with a CVSS score of 7.0, indicating high severity. Despite this, Microsoft’s initial advisory on November 1, 2025, dismissed the need for a specific patch. Their argument relied on two defenses:
- User Warnings: The operating system generates prompts when processing LNK files.
- Smart App Control: Existing Defender mechanisms and Smart App Control theoretically block malicious downloads.
However, the security landscape has changed. ACROS Security (the team behind 0patch) recently confirmed that Microsoft has silently deployed a fix. This update prevents the concealment of malicious arguments within shortcut files, effectively admitting the necessity of a patch they previously deemed unnecessary.
Technical Implications and Third-Party Mitigation
Before Microsoft’s intervention, the gap in security was filled by the third-party provider 0patch. They released a “micropatch” months ago to block this specific attack vector. This incident highlights a critical lesson for IT administration: relying solely on vendor timelines can leave infrastructure exposed.
The vulnerability exploits the gap between what the user sees and what the operating system executes. By hiding the arguments, attackers bypass the “human firewall”—your scrutiny of file properties.
Advisor Recommendations
To secure your environment against CVE-2025-9491, take the following steps immediately:
- Verify Update Status: Ensure all Windows endpoints have received the latest cumulative updates. The silent patch is likely included in recent rollouts.
- Review LNK Policies: If you are in a high-security environment, consider restricting the execution of LNK files from temporary folders or untrusted sources via Group Policy.
- Consider Micropatching: For legacy systems or environments where official patching is delayed, solutions like 0patch provide critical interim protection.
- Educate Users: Remind staff that inspecting file properties is no longer a foolproof method for verifying safety. Rely on automated scanning tools rather than manual inspection.