Internet Shortcut Files Security Feature Bypass Vulnerability

Windows Internet Shortcut files (.url) can bypass security features that are designed to protect users from malicious content. An attacker can craft a specially formatted shortcut file that tricks Windows into ignoring its own safety checks.

A security feature bypass in Windows Internet Shortcut file handling (CWE-693: Improper Neutralization of Special Elements) allows attackers to craft malicious .url files that circumvent mark-of-the-web and other protective mechanisms. The attack requires user interaction to open the crafted file, but successfully bypassed protections can lead to arbitrary code execution or elevation of privilege.