{"id":"CVE-2025-33053","aliases":[],"url":"https://o3.security/vulnerability/CVE-2025-33053","summary":"External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.","details":"External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.","published":"2025-06-10T17:22:18.853","modified":"2026-06-17T09:13:01.030","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"score":0.87607,"percentile":0.99749,"asOf":"2026-09-16"},"cisaKev":{"dateAdded":"2025-06-10","dueDate":"2025-07-01","knownRansomwareCampaignUse":false},"exploitsKnown":2,"affectedPackages":[],"fix":null,"references":[{"type":"ADVISORY","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33053"},{"type":"EXPLOIT","url":"https://research.checkpoint.com/2025/stealth-falcon-zero-day/"},{"type":"WEB","url":"https://therecord.media/microsoft-cisa-zero-day-turkish-defense-org"},{"type":"WEB","url":"https://www.bleepingcomputer.com/news/security/stealth-falcon-hackers-exploited-windows-webdav-zero-day-to-drop-malware/"},{"type":"WEB","url":"https://www.darkreading.com/vulnerabilities-threats/stealth-falcon-apt-exploits-microsoft-rce-zero-day-mideast"},{"type":"WEB","url":"https://www.theregister.com/2025/06/10/microsoft_patch_tuesday_june/"},{"type":"EXPLOIT","url":"https://www.vicarius.io/vsociety/posts/cve-2025-33053-detection-script-remote-code-execution-vulnerability-in-microsoft-webdav"},{"type":"EXPLOIT","url":"https://www.vicarius.io/vsociety/posts/cve-2025-33053-mitigation-script-remote-code-execution-vulnerability-in-microsoft-webdav"},{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-33053"}],"provenance":{"sources":["OSV.dev","NVD","CISA KEV","FIRST.org (EPSS)"],"lastVerified":"2026-06-17T09:13:01.030"}}