Microsoft Patches Repeated Windows Mark-of-the-Web and SmartScreen Bypass Flaws

Microsoft has disclosed a sustained series of security feature bypass vulnerabilities across Windows and related components, with multiple advisories tied to Mark of the Web (MotW), SmartScreen, MapUrlToZone, Windows shortcut handling, and security zone mapping. The most detailed recent case, CVE-2026-32225, affects Windows Shell and allows attackers to bypass SmartScreen protections that rely on MotW by persuading a user to open a specially crafted .lnk file. Microsoft said successful exploitation could cause Windows to launch commands or Control Panel applets without proper MotW handling, potentially enabling arbitrary command execution or the loading of attacker-controlled DLLs; the flaw was rated Important, assigned a CVSS 8.8, marked as more likely to be exploited, and fixed at disclosure.

The newer Windows Shell issue follows a broader pattern of Microsoft fixes for related bypasses, including CVE-2022-44698 in Windows SmartScreen; CVE-2023-36564 in Windows Search; CVE-2023-36584, CVE-2024-38217, and CVE-2024-43487 in Windows Mark of the Web; CVE-2024-30073 in Windows Security Zone Mapping; CVE-2025-21328, CVE-2025-21329, and CVE-2025-21332 in MapUrlToZone; and CVE-2025-47160 in Windows Shortcut Files. Additional bypass advisories affected Microsoft products including Publisher, Office Developer Platform, PowerShell, Kerberos, Windows Hello, Surface, and PC Manager, underscoring Microsoft's continued effort to close gaps in trust labeling and execution safeguards that attackers can abuse to reduce warnings and increase the success of social-engineering attacks.