All CVE records
CVE-2025-33053 — Microsoft Windows External Control of File Name or Path Vulnerability
CISA KEV listed
Added June 10, 2025 Remediate by July 1, 2025
Description
Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053 ; https://nvd.nist.gov/vuln/detail/CVE-2025-33053
Need help remediating this vulnerability?
Our team helps organizations patch, mitigate, and respond to CISA KEV advisories fast.