This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Microsoft Windows zero-day vulnerability
security researchers from Arctic Wolf Labs warn of a new wave of cyber attacks actively targeting European organizations, including government and diplomatic targets, and exploiting a yet unpatched vulnerability in Microsoft Windows designated CVE-2025-9491 [1][2]. As Microsoft has not yet released an official patch, it is recommended to limit the use of .LNK files from untrusted sources and to block connections to the C2 infrastructure identified by the company [2].
Due to incorrect handling of .LNK files, which can hide malicious content when displayed in the standard Windows interface, an unauthenticated remote attacker can execute arbitrary code in the context of the currently logged-in user. Exploitation requires user interaction by opening a malicious file or visiting a malicious page [2].
The vulnerability is present in product:
- Windows;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-9491 at cve.org, NVD
- CWE-451: User Interface (UI) Misrepresentation of Critical Information at cwe.mitre.org
The vulnerability was publicly disclosed 26. 8. 2025.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 4. 11. 2025.