All vulnerabilities
CVE-2025-33053

Microsoft Windows External Control of File Name or Path Vulnerability

Microsoft WindowsOperating systems
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationExploited in the wildAdded to KEV 10 Jun 2025CISA KEV
Exploit odds (EPSS)87.0%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.0.10240.21034Also 10.0.14393.8148, 10.0.17763.7434 and 11 moreCVE List
Federal deadline1 Jul 2025Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

  • 10.0.10240.21034Windows 10 Version 1507CVE List
  • 10.0.14393.8148Windows 10 Version 1607CVE List
  • 10.0.17763.7434Windows 10 Version 1809CVE List
  • 10.0.19044.5965Windows 10 Version 21H2CVE List
  • 10.0.19045.5965Windows 10 Version 22H2CVE List
  • 10.0.22621.5472Windows 11 version 22H2CVE List
Show all 25 fixed versions
  • 10.0.22631.5472Windows 11 version 22H3CVE List
  • 10.0.22631.5472Windows 11 Version 23H2CVE List
  • 10.0.26100.4349Windows 11 Version 24H2CVE List
  • 6.1.7601.27769Windows Server 2008 R2 Service Pack 1CVE List
  • 6.1.7601.27769Windows Server 2008 R2 Service Pack 1 (Server Core installation)CVE List
  • 6.0.6003.23351Windows Server 2008 Service Pack 2CVE List
  • 6.0.6003.23351Windows Server 2008 Service Pack 2 (Server Core installation)CVE List
  • 6.2.9200.25522Windows Server 2012CVE List
  • 6.2.9200.25522Windows Server 2012 (Server Core installation)CVE List
  • 6.3.9600.22620Windows Server 2012 R2CVE List
  • 6.3.9600.22620Windows Server 2012 R2 (Server Core installation)CVE List
  • 10.0.14393.8148Windows Server 2016CVE List
  • 10.0.14393.8148Windows Server 2016 (Server Core installation)CVE List
  • 10.0.17763.7434Windows Server 2019CVE List
  • 10.0.17763.7434Windows Server 2019 (Server Core installation)CVE List
  • 10.0.20348.3807Windows Server 2022CVE List
  • 10.0.25398.1665Windows Server 2022, 23H2 Edition (Server Core installation)CVE List
  • 10.0.26100.4349Windows Server 2025CVE List
  • 10.0.26100.4349Windows Server 2025 (Server Core installation)CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 10 Jun 2025Added to CISA KEVCISA KEV
  2. 10 Jun 2025, 17:02 UTCPublishedCVE List
  3. 11 Jun 2025Exploit code publicMetasploit

Public exploit code and templates 1

  • Exploit moduleCVE-2025-33053 Exploit via Malicious .URL File and WebDAV 11 Jun 2025Metasploit

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files.

Text from CVE List

Affected versions 25

  • Windows 10 Version 1507affected: 10.0.10240.0 before 10.0.10240.21034CVE List
  • Windows 10 Version 1607affected: 10.0.14393.0 before 10.0.14393.8148CVE List
  • Windows 10 Version 1809affected: 10.0.17763.0 before 10.0.17763.7434CVE List
  • Windows 10 Version 21H2affected: 10.0.19044.0 before 10.0.19044.5965CVE List
  • Windows 10 Version 22H2affected: 10.0.19045.0 before 10.0.19045.5965CVE List
  • Windows 11 version 22H2affected: 10.0.22621.0 before 10.0.22621.5472CVE List
  • Windows 11 version 22H3affected: 10.0.22631.0 before 10.0.22631.5472CVE List
  • Windows 11 Version 23H2affected: 10.0.22631.0 before 10.0.22631.5472CVE List
  • Windows 11 Version 24H2affected: 10.0.26100.0 before 10.0.26100.4349CVE List
  • Windows Server 2008 R2 Service Pack 1affected: 6.1.7601.0 before 6.1.7601.27769CVE List
  • Windows Server 2008 R2 Service Pack 1 (Server Core installation)affected: 6.1.7601.0 before 6.1.7601.27769CVE List
  • Windows Server 2008 Service Pack 2affected: 6.0.6003.0 before 6.0.6003.23351CVE List
  • Windows Server 2008 Service Pack 2 (Server Core installation)affected: 6.0.6003.0 before 6.0.6003.23351CVE List
  • Windows Server 2012affected: 6.2.9200.0 before 6.2.9200.25522CVE List
  • Windows Server 2012 (Server Core installation)affected: 6.2.9200.0 before 6.2.9200.25522CVE List
  • Windows Server 2012 R2affected: 6.3.9600.0 before 6.3.9600.22620CVE List
  • Windows Server 2012 R2 (Server Core installation)affected: 6.3.9600.0 before 6.3.9600.22620CVE List
  • Windows Server 2016affected: 10.0.14393.0 before 10.0.14393.8148CVE List
  • Windows Server 2016 (Server Core installation)affected: 10.0.14393.0 before 10.0.14393.8148CVE List
  • Windows Server 2019affected: 10.0.17763.0 before 10.0.17763.7434CVE List
  • Windows Server 2019 (Server Core installation)affected: 10.0.17763.0 before 10.0.17763.7434CVE List
  • Windows Server 2022affected: 10.0.20348.0 before 10.0.20348.3807CVE List
  • Windows Server 2022, 23H2 Edition (Server Core installation)affected: 10.0.25398.0 before 10.0.25398.1665CVE List
  • Windows Server 2025affected: 10.0.26100.0 before 10.0.26100.4349CVE List
  • Windows Server 2025 (Server Core installation)affected: 10.0.26100.0 before 10.0.26100.4349CVE List

References 11