CVE-2025-33053
Microsoft Windows External Control of File Name or Path Vulnerability
Description
CVE-2025-33053 is a high-severity remote code execution vulnerability in Microsoft Windows caused by external control of file name or path in Internet Shortcut Files. The vulnerability allows an unauthorized attacker to execute arbitrary code over a network by crafting malicious internet shortcut files that exploit WebDAV path handling. With a CVSS v3.1 base score of 8.8 (HIGH severity), the flaw is remotely exploitable without authentication, though it requires user interaction to open the malicious shortcut. CISA has added CVE-2025-33053 to the Known Exploited Vulnerabilities catalog, and its EPSS score of 34.26% at the 97th percentile indicates significant exploitation activity. The vulnerability has been linked to the Stealth Falcon APT group targeting organizations in the Middle East and affects virtually all supported Windows versions.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.21034 |
| microsoft | windows 10 1607 | < 10.0.14393.8148 |
| microsoft | windows 10 1809 | < 10.0.17763.7434 |
| microsoft | windows 10 21h2 | < 10.0.19044.5965 |
| microsoft | windows 10 22h2 | < 10.0.19045.5965 |
| microsoft | windows 11 22h2 | < 10.0.22621.5472 |
| microsoft | windows 11 23h2 | < 10.0.22631.5472 |
| microsoft | windows 11 24h2 | < 10.0.26100.4270 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.8148 |
| microsoft | windows server 2019 | < 10.0.17763.7434 |
| microsoft | windows server 2022 | < 10.0.20348.3745 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1665 |
| microsoft | windows server 2025 | < 10.0.26100.4270 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33053(Vendor Advisory)
- https://research.checkpoint.com/2025/stealth-falcon-zero-day/(Exploit, Technical Description)
- https://therecord.media/microsoft-cisa-zero-day-turkish-defense-org(Press/Media Coverage)
- https://www.bleepingcomputer.com/news/security/stealth-falcon-hackers-exploited-windows-webdav-zero-day-to-drop-malware/(Press/Media Coverage)
- https://www.darkreading.com/vulnerabilities-threats/stealth-falcon-apt-exploits-microsoft-rce-zero-day-mideast(Press/Media Coverage)
- https://www.theregister.com/2025/06/10/microsoft_patch_tuesday_june/(Press/Media Coverage)
- https://www.vicarius.io/vsociety/posts/cve-2025-33053-detection-script-remote-code-execution-vulnerability-in-microsoft-webdav(Exploit, Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-33053-mitigation-script-remote-code-execution-vulnerability-in-microsoft-webdav(Exploit, Mitigation, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-33053(US Government Resource)
Weakness Type
CWE-73: External Control of File Name or Path
The external control of file name or path weakness in CVE-2025-33053 allows an attacker to specify or influence file paths that the application uses in security-critical operations. In Windows Internet Shortcut Files, an attacker can craft malicious shortcut files that control the target file path, leading to code execution when a user opens the shortcut through WebDAV path handling.
Learn more: CWE-73 — External Control of File Name or Path
Impact Analysis
The impact of CVE-2025-33053 is severe with Confidentiality (High), Integrity (High), and Availability (High) all fully compromised. The vulnerability is network-accessible (AV:N) with low complexity (AC:L) and requires no privileges (PR:N), though it does require user interaction (UI:R) in the form of opening a malicious internet shortcut file. Once triggered, the attacker gains remote code execution on the target system, allowing complete system compromise including data theft, malware installation, and lateral movement within the network. The EPSS score of 34.3% at the 97th percentile confirms significant active exploitation. The attribution to the Stealth Falcon APT group, which is linked to state-sponsored operations targeting defense organizations in the Middle East, elevates the risk profile for government and military networks. The vulnerability affects all supported Windows versions from Windows 10 through Windows Server 2025.
Exploit Maturity
CVE-2025-33053 demonstrates high exploit maturity with confirmed active exploitation by the Stealth Falcon APT group. Public exploit code and detection scripts are available from Check Point Research and Vicarius. CISA has added the vulnerability to the Known Exploited Vulnerabilities catalog, and the EPSS score of 34.26% at the 97th percentile confirms significant exploitation activity. The Stealth Falcon group, also known as FruityArmor, is a UAE-linked APT that has targeted defense organizations, journalists, and dissidents primarily in the Middle East. The availability of both exploitation and mitigation scripts from multiple security vendors indicates that this vulnerability is well-understood and actively targeted in the wild.
Remediation
-
Apply the June 2025 Microsoft security updates immediately as detailed in the Microsoft Security Response Center advisory. Ensure all Windows versions in your environment are updated, from Windows 10 1507 through Windows Server 2025.
-
Block or restrict WebDAV traffic at the network perimeter as an interim mitigation. Disable the WebClient service on systems where it is not required, as the vulnerability leverages WebDAV path handling in internet shortcut files.
-
Implement email and web gateway filtering to block or quarantine internet shortcut files (.url, .lnk) received from external sources. Configure attachment filtering rules to prevent delivery of malicious shortcut files through email, file-sharing platforms, and web downloads.
-
Deploy endpoint detection rules based on the indicators published by Check Point Research to detect Stealth Falcon attack patterns. Monitor for suspicious WebDAV connections, unusual .url file execution, and the specific malware payloads associated with this campaign.
-
Educate users about the risks of opening internet shortcut files from untrusted sources. Implement application control policies (AppLocker, WDAC) to restrict execution of untrusted shortcut files and scripts, particularly on systems in high-risk environments.
Technical Details
CVE-2025-33053 is a remote code execution vulnerability caused by external control of file name or path in Microsoft Windows Internet Shortcut Files. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a network-accessible (AV:N), low-complexity (AC:L) attack requiring no privileges (PR:N) but requiring user interaction (UI:R), with high impact across all CIA dimensions. The vulnerability exploits how Windows processes Internet Shortcut (.url) files that reference WebDAV paths. When a user opens a specially crafted shortcut file, Windows follows the embedded path through the WebDAV client (WebClient service), which can be manipulated to load and execute a malicious payload from an attacker-controlled server. The path handling logic fails to properly validate or restrict the file resources that can be referenced through the WebDAV protocol, allowing the attacker to control which code is ultimately executed on the victim's system. The Stealth Falcon APT group exploited this as a zero-day by delivering malicious .url files to targets, likely through spear-phishing emails, which when opened triggered the WebDAV-based code execution chain. The vulnerability affects all supported Windows versions because the WebClient service and internet shortcut file handling are core Windows components present since Windows Server 2008.
Frequently Asked Questions
Is CVE-2025-33053 being actively exploited?
Yes, CVE-2025-33053 has been exploited as a zero-day by the Stealth Falcon APT group, targeting defense organizations in the Middle East. CISA has added it to the Known Exploited Vulnerabilities catalog, and the EPSS score of 34.26% at the 97th percentile confirms significant exploitation activity.
What products are affected by CVE-2025-33053?
Virtually all supported Windows versions are affected, including Windows 10 (versions 1507 through 22H2), Windows 11 (22H2, 23H2, 24H2), and Windows Server 2008 through Windows Server 2025. The vulnerability exists in the Windows internet shortcut file handling with WebDAV paths.
How do I fix CVE-2025-33053?
Apply the June 2025 Microsoft security updates from the Microsoft Security Response Center. As an interim mitigation, disable the WebClient service on systems where WebDAV is not required, and implement email/web gateway filtering to block malicious shortcut files.
How severe is CVE-2025-33053?
CVE-2025-33053 is rated HIGH with a CVSS v3.1 score of 8.8. The vulnerability enables remote code execution when a user opens a crafted internet shortcut file, and the confirmed exploitation by a state-sponsored APT group elevates the real-world risk beyond the technical severity score.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.