What CVEs are caused by CWE-64?

9 recorded CVEs are attributed to CWE-64, including CVE-2025-53503, CVE-2025-52837, CVE-2025-52521.

What are the consequences of CWE-64?

Exploiting CWE-64 can lead to: Read Files or Directories, Modify Files or Directories.

Is CWE-64 actively exploited?

9 recorded CVEs are caused by CWE-64; none are currently in CISA's KEV catalog of actively exploited flaws.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Variant weakness

Incomplete

CWE-64: Windows Shortcut Following (.LNK)

Also known as: Windows symbolic link following, symlink

The product, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Last updated May 1, 2026

9

Recorded CVEs

With this primary weakness

0

KEVs

In the CISA KEV catalog

Low

Likelihood of exploit

Per MITRE

Variant

Abstraction

MITRE classification

Overview

CWE-64 (Windows Shortcut Following (.LNK)) is a variant-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.

Real-world CVEs

9 recorded CVEs are caused by CWE-64 (Windows Shortcut Following (.LNK)). The highest-severity and most recent are shown first. 0 new CWE-64 CVEs have been recorded so far in 2026 (7 in 2025).

High · CVSS 7.8 · EPSS 4th

2025-06-17

CVE-2025-49384

High · CVSS 7.8 · EPSS 4th

2025-06-17

CVE-2021-1492

High · CVSS 7.1 · EPSS 19th

2021-03-25

CVE-2025-48443

Medium · CVSS 6.7 · EPSS 8th

2025-06-17

CVE-2021-41562

Medium · CVSS 6.1 · EPSS 16th

2021-11-03

CVE-2025-7376

Information Tampering Vulnerability in Multiple Processes of GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, IoTWorX, MC Works64, and GENESIS

Medium · CVSS 5.9 · EPSS 9th

2025-08-06

Common consequences

What can happen when CWE-64 is exploited.

Read Files or Directories, Modify Files or Directories

Affects: Confidentiality, Integrity

The shortcut (file with the .lnk extension) can permit an attacker to read/write a file that they originally did not have permissions to access.

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Operation

Applies to

Operating systems

Windows

How to prevent it

Practical mitigations for CWE-64, grouped by where in the lifecycle they apply.

Architecture and Design

Separation of Privilege

Follow the principle of least privilege when assigning access rights to entities in a software system.

Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2019-19793 — network access control service executes program with high privileges and allows symlink to invoke another executable or perform DLL injection.
CVE-2000-0342 — Mail client allows remote attackers to bypass the user warning for executable attachments such as .exe, .com, and .bat by using a .lnk file that refers to the attachment, aka "Stealth Attachment."
CVE-2001-1042 — FTP server allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.
CVE-2001-1043 — FTP server allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.
CVE-2005-0587 — Browser allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link) file twice, which overwrites the file that was referenced in the first .LNK file.
CVE-2001-1386 — ".LNK." - .LNK with trailing dot
CVE-2003-1233 — Rootkits can bypass file access restrictions to Windows kernel directories using NtCreateSymbolicLinkObject function to create symbolic link

Terminology & mappings

Alternate terms

Windows symbolic link following
symlink

Mapped taxonomies

PLOVER: Windows Shortcut Following (.LNK)
CERT C Secure Coding: Identify files using multiple file attributes (FIO05-C)
Software Fault Patterns: Link in resource name resolution (SFP18)

Frequently asked questions

Common questions about CWE-64.

What is CWE-64?: The product, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
What CVEs are caused by CWE-64?: 9 recorded CVEs are attributed to CWE-64, including CVE-2025-53503, CVE-2025-52837, CVE-2025-52521.
How do you prevent CWE-64?: Follow the principle of least privilege when assigning access rights to entities in a software system.
What are the consequences of CWE-64?: Exploiting CWE-64 can lead to: Read Files or Directories, Modify Files or Directories.
Is CWE-64 actively exploited?: 9 recorded CVEs are caused by CWE-64; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-64

Get alerted the moment a new CWE-64 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Applies to

How to prevent it

Illustrative examples

Related weaknesses

Parent

Terminology & mappings

Alternate terms

Mapped taxonomies

Frequently asked questions

References

Stay ahead of CWE-64