Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Windows Shell Link files can leak sensitive information

CVE-2026-25185
Summary

Windows Shell Link files can expose sensitive information to unauthorized users who access them, potentially allowing attackers to impersonate legitimate users or systems. This issue affects Windows users who share or store sensitive data in Shell Link files. To mitigate this risk, ensure sensitive information is not stored in Shell Link files and consider using alternative file formats or encryption.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software
VendorProductAffected versionsFix available
microsoft windows_10_1607 <= 10.0.14393.8957
microsoft windows_10_1607 <= 10.0.14393.8957
microsoft windows_10_1809 <= 10.0.17763.8511
microsoft windows_10_1809 <= 10.0.17763.8511
microsoft windows_10_21h2 <= 10.0.19044.7058
microsoft windows_10_21h2 <= 10.0.19044.7058
microsoft windows_10_21h2 <= 10.0.19044.7058
microsoft windows_10_22h2 <= 10.0.19045.7058
microsoft windows_10_22h2 <= 10.0.19045.7058
microsoft windows_10_22h2 <= 10.0.19045.7058
microsoft windows_11_23h2 <= 10.0.22631.6783
microsoft windows_11_23h2 <= 10.0.22631.6783
microsoft windows_11_24h2 <= 10.0.26100.7979
microsoft windows_11_24h2 <= 10.0.26100.7979
microsoft windows_11_25h2 <= 10.0.26200.7979
microsoft windows_11_25h2 <= 10.0.26200.7979
microsoft windows_11_26h1 <= 10.0.28000.1719
microsoft windows_11_26h1 <= 10.0.28000.1719
microsoft windows_server_2012 All versions
microsoft windows_server_2012 r2
microsoft windows_server_2016 <= 10.0.14393.8957
microsoft windows_server_2019 <= 10.0.17763.8511
microsoft windows_server_2022 <= 10.0.20348.4830
microsoft windows_server_2022_23h2 <= 10.0.25398.2207
microsoft windows_server_2025 <= 10.0.26100.32463
Original title
Exposure of sensitive information to an unauthorized actor in Windows Shell Link Processing allows an unauthorized attacker to perform spoofing over a network.
Original description
Exposure of sensitive information to an unauthorized actor in Windows Shell Link Processing allows an unauthorized attacker to perform spoofing over a network.
nvd CVSS3.1 5.3
Vulnerability type
CWE-200 Information Exposure
Published: 10 Mar 2026 · Updated: 14 Mar 2026 · First seen: 11 Mar 2026