ADR 0035: LNK argument padding detection (CVE-2025-9491)

Status: Accepted Date: 2026-07-20 Issue: #473

Context

CVE-2025-9491 is a Windows Shortcut (.lnk) UI-misrepresentation defect. When the COMMAND_LINE_ARGUMENTS field in an MS-SHLLINK shortcut begins with 260 or more whitespace characters, the Windows Explorer Properties dialog truncates the display before the real command becomes visible. A user inspecting a shortcut that appears to invoke notepad.exe may not see that the arguments field actually carries powershell.exe -enc <payload> after the padding.

Microsoft declined to fully patch the underlying rendering behavior. A partial mitigation shipped in June 2025, and ACROS Security released a 0patch micropatch. Because the defect is in the rendering layer and not the shortcut loader, host mitigations alone do not guarantee that every downstream reviewer sees the true command. Arbitraitor must detect the pattern at inspection time so a finding is raised before any release or execution decision.

Spec §19.1 lists archive formats and §15.3 describes suspicious script behavior, but neither section names .lnk as a content class nor describes a whitespace-padding detection rule. This ADR fills both gaps.

Decision

Arbitraitor adds ArtifactType::WindowsShortcut as a first-class content class in arbitraitor-artifact. The classifier detects the MS-SHLLINK header magic (HeaderSize field equal to 0x0000004C at offset 0) and returns the new variant at Confidence::Confirmed.

A new arbitraitor_artifact::lnk module implements a bounded, pure-Rust MS-SHLLINK parser. The parser:

1. Validates the ShellLinkHeader (76 bytes, HeaderSize == 0x4C).
2. Reads the Flags field at offset 0x14.
3. Skips the optional LinkTargetIDList (when HasLinkTargetIDList is set) using its 2-byte IDListSize prefix.
4. Skips the optional LinkInfo section (when HasLinkInfo is set and ForceNoLinkInfo is clear) using its 4-byte LinkInfoSize prefix.
5. Walks the StringData section in spec order (NAME_STRING, RELATIVE_PATH, WORKING_DIR, COMMAND_LINE_ARGUMENTS, ICON_LOCATION) and extracts COMMAND_LINE_ARGUMENTS when the HasArguments flag is set.
6. Decodes the string as UTF-16LE when the Unicode flag is set, or as ASCII otherwise.

When the extracted COMMAND_LINE_ARGUMENTS field begins with 260 or more consecutive whitespace characters, the inspector emits a finding with:

• id: artifact.lnk-argument-padding
• category: FindingCategory::SuspiciousScriptBehavior (spec §15.3)
• severity: High
• confidence: Confirmed
• references: CVE-2025-9491
• tags: cve-2025-9491, lnk, ui-misrepresentation

The threshold of 260 characters matches the Windows Explorer Properties dialog truncation point identified by ACROS Security. The parser is cross-platform: it uses pure byte manipulation and never calls Windows APIs, so detection works on Linux and macOS inspection hosts.

The parser is bounded per spec invariant 4. LinkTargetIDList, LinkInfo, and each StringData string are rejected when their declared sizes exceed 64 KiB or extend past the input. The parser never executes the shortcut target and never writes bytes outside the CAS quarantine.

Consequences

• .lnk artifacts are classified as WindowsShortcut at Confirmed confidence, so policy rules can gate shortcuts without a separate detector.
• Shortcuts with padded arguments raise a SuspiciousScriptBehavior finding that participates in normal verdict calculation. A clean shortcut produces no finding.
• The parser does not validate the full MS-SHLLINK structure. It extracts only the COMMAND_LINE_ARGUMENTS field needed for CVE-2025-9491 detection. Future detectors that need the target path, icon location, or environment variables can extend the parser without changing the content class.
• The 260-character threshold is a detection heuristic, not a format requirement. Legitimate shortcuts with long but visible arguments are not flagged because the rule requires leading whitespace, not total length.
• No new production dependency is added. The parser uses arbitraitor-model types and sha2 (already in the crate manifest) and is #![forbid(unsafe_code)].

Alternatives considered

Shell out to a Windows-only tool

Rejected. Arbitraitor inspection hosts run on Linux and macOS. A Windows-only parser would make .lnk detection non-portable and introduce a subprocess dependency for a deterministic byte-format check.

Add a lnk crate from crates.io

Rejected for this change. The MS-SHLLINK fields needed for CVE-2025-9491 detection are a header, two optional skip sections, and one counted string. A bounded pure-Rust parser is smaller than the admission checklist cost of a new dependency. This decision can be revisited if future detectors need full MS-SHLLINK coverage (target path, environment variables, extra data).

Detect any whitespace run, not just leading whitespace

Rejected. The CVE-2025-9491 pattern is leading whitespace that pushes the real command out of the visible area. A whitespace run in the middle of an argument list is not the same defect and would produce false positives.

Set the threshold at 259 characters

Rejected. The ACROS Security analysis and the Windows Explorer rendering limit point to 260 as the truncation width. Using 260 keeps the detector aligned with the observed defect and avoids off-by-one ambiguity.

References

• Arbitraitor spec §19.1, content classes.
• Arbitraitor spec §15.3, suspicious script behavior.
• CVE-2025-9491: Windows Shortcut LNK UI misrepresentation.
• ACROS Security 0patch micropatch for CVE-2025-9491.
• MS-SHLLINK: Shell Link (.lnk) Binary File Format.
• ADR-0032: Tar parser consensus check (precedent for bounded pure-Rust parser).