Windows Internet Shortcut Files path control allows remote code execution
External control of file name or path in Windows Internet Shortcut Files lets a remote attacker execute code over a network without authentication. CVSS 8.8. Patched June 2025.
- Vendor
- Microsoft
- Product
- Windows (Internet Shortcut Files)
- CVSS
- 8.8
- EPSS (exploit probability)
- 87.1%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2025-33053 being exploited?
Yes. CISA added CVE-2025-33053 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 87.1% (scored November 6, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2025-33053 timeline
- Added to CISA KEVsame day as NVD
- Published to NVD
- First 0dayNews coverage+405d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (21 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
External control of file name or path (CWE-73) in Windows Internet Shortcut Files. An attacker serving a crafted .url file over a network share or WebDAV can direct the client to execute code via iediagcmd.exe working-directory hijacking.
Context
Rapid7 researchers found a threat actor actively QA’ing this CVE against their own delivery lab before deploying it against targets. The lab (exposed accidentally on a listable WebDAV server) held 453 shortcut launchers and 146 LOLBin execution tests — the operator was validating delivery chains that included this flaw alongside CVE-2026-21513 and CVE-2025-24054. Observed delivery methods: search-ms: URIs, .library-ms files, right-to-left override lures, and signed-binary abuse.
The attacker’s lab being observable does not mean this CVE is theoretical. 2,384 confirmed phishing-page launch events against Mexican targets were recorded during the same window.
What to do
- Patch. Microsoft released a fix in the June 2025 Patch Tuesday cycle. Confirm it’s applied — this is not a complicated update to test.
- Gateway controls. Block
.urland.library-msattachments at the mail gateway. These file types have narrow legitimate use cases and broad abuse history. - Monitor WebDAV activity. Rapid7 flagged this CVE via MDR telemetry on
rundll32.exepulling from a WebDAV path. WebDAV client activity from user endpoints is worth alerting on.
Sources
- NVD CVE-2025-33053
- Rapid7 threat research: exposed WebDAV malware lab (via our coverage)
Other Microsoft Windows CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-96951 Microsoft Windows Command Injection Vulnerability | [ HIGH ] | 8.8 | 9.8% | |
| CVE-2026-85880 Microsoft Windows ALPC Heap Buffer Overflow Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 0.4% | |
| CVE-2026-81963 Microsoft Windows Update Stack Link-Following Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 7.1% | |
| CVE-2026-68820 Windows AFD WinSock Use-After-Free Privilege Escalationwrite-up | [ HIGH ] | 7.0 | 8.6% | |
| CVE-2008-4250 Microsoft Windows Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 98.8% | |
| CVE-2026-32202 Microsoft Windows Protection Mechanism Failure Vulnerability | [ MEDIUM ] | 4.3 | 71.3% | |
| CVE-2025-60710 Microsoft Windows Link Following Vulnerabilityransomware use | [ HIGH ] | 7.8 | 4.6% | |
| CVE-2023-36424 Microsoft Windows Out-of-Bounds Read Vulnerability | [ HIGH ] | 7.8 | 12.1% |
