Windows Internet Shortcut Files path control allows remote code execution

External control of file name or path (CWE-73) in Windows Internet Shortcut Files. An attacker serving a crafted .url file over a network share or WebDAV can direct the client to execute code via iediagcmd.exe working-directory hijacking.

Context

Rapid7 researchers found a threat actor actively QA’ing this CVE against their own delivery lab before deploying it against targets. The lab (exposed accidentally on a listable WebDAV server) held 453 shortcut launchers and 146 LOLBin execution tests — the operator was validating delivery chains that included this flaw alongside CVE-2026-21513 and CVE-2025-24054. Observed delivery methods: search-ms: URIs, .library-ms files, right-to-left override lures, and signed-binary abuse.

The attacker’s lab being observable does not mean this CVE is theoretical. 2,384 confirmed phishing-page launch events against Mexican targets were recorded during the same window.

What to do

1. Patch. Microsoft released a fix in the June 2025 Patch Tuesday cycle. Confirm it’s applied — this is not a complicated update to test.
2. Gateway controls. Block .url and .library-ms attachments at the mail gateway. These file types have narrow legitimate use cases and broad abuse history.
3. Monitor WebDAV activity. Rapid7 flagged this CVE via MDR telemetry on rundll32.exe pulling from a WebDAV path. WebDAV client activity from user endpoints is worth alerting on.

Sources

• NVD CVE-2025-33053
• Rapid7 threat research: exposed WebDAV malware lab (via our coverage)