CVE-2025-33053: Microsoft Windows External Control of File Name or Path Vulnerability

Published Jun 10, 2025
·
Updated

External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.

Other sources

Internet Shortcut Files Remote Code Execution Vulnerability

— Microsoft

Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files.

— CISA

Affected Software

103 affected componentsFixes available
Microsoft Windows Server 2022, 23H2 Edition
Patch available
Microsoft Windows 11=23H2
Patch available
Microsoft Windows 11=23H2
Patch available
Microsoft Windows 10=22H2
Patch available
Microsoft Windows 11=22H2
Patch available
Microsoft Windows 10=22H2
Patch available
Microsoft Windows 10=21H2
Patch available
Microsoft Windows Server 2025
Patch availablePatch available
Microsoft Windows 10=22H2
Patch available
Microsoft Windows 11=22H2
Patch available
Microsoft Windows 10=21H2
Patch available
Microsoft Windows Server 2019
Patch available
Microsoft Windows 10=1607
Patch available
Microsoft Windows Server 2012
Patch availablePatch available
Microsoft Windows 10=1809
Patch available
Microsoft Windows 10=1809
Patch available
Microsoft Windows Server 2019
Patch available
Microsoft Windows Server 2008
Patch availablePatch available
Microsoft Windows Server 2016
Patch available
Microsoft Windows Server 2022
Patch availablePatch available
Microsoft Windows Server 2022
Patch availablePatch available
Microsoft Windows 10
Patch available
Microsoft Windows Server 2012 R2
Patch availablePatch available
Microsoft Windows Server 2008
Patch availablePatch available
Microsoft Windows Server 2012 R2
Patch availablePatch available
Microsoft Windows Server 2012
Patch availablePatch available
Microsoft Windows Server 2008 R2
Patch availablePatch available
Microsoft Windows Server 2016
Patch available
Microsoft Windows 10=1607
Patch available
Microsoft Windows 11=24H2
Patch availablePatch available
Microsoft Windows 11=24H2
Patch availablePatch available
Microsoft Windows Server 2008 R2
Patch availablePatch available
Microsoft Windows 10
Patch available
Microsoft Windows Server 2008
Patch availablePatch available
Microsoft Windows Server 2025
Patch availablePatch available
Microsoft Windows Server 2008
Patch availablePatch available
Microsoft Windows 10=21H2
Patch available
Microsoft Windows
Microsoft Windows 10 1507<10.0.10240.21034
Microsoft Windows 10 1507<10.0.10240.21034
Microsoft Windows 10 1607<10.0.14393.8148
Microsoft Windows 10 1607<10.0.14393.8148
Microsoft Windows 10 1809<10.0.17763.7434
Microsoft Windows 10 1809<10.0.17763.7434
Microsoft Windows 10 21h2<10.0.19044.5965
Microsoft Windows 10 21h2<10.0.19044.5965
Microsoft Windows 10 21h2<10.0.19044.5965
Microsoft Windows 10 22h2<10.0.19045.5965
Microsoft Windows 10 22h2<10.0.19045.5965
Microsoft Windows 10 22h2<10.0.19045.5965
Microsoft Windows 11 22h2<10.0.22621.5472
Microsoft Windows 11 22h2<10.0.22621.5472
Microsoft Windows 11 23h2<10.0.22631.5472
Microsoft Windows 11 23h2<10.0.22631.5472
Microsoft Windows 11 24h2<10.0.26100.4270
Microsoft Windows 11 24h2<10.0.26100.4270
Microsoft Windows Server 2008=sp2
Microsoft Windows Server 2008=sp2
Microsoft Windows Server 2008=r2-sp1
Microsoft Windows Server 2012
Microsoft Windows Server 2012=r2
Microsoft Windows Server 2016<10.0.14393.8148
Microsoft Windows Server 2019<10.0.17763.7434
Microsoft Windows Server 2022<10.0.20348.3745
Microsoft Windows Server 2022 23h2<10.0.25398.1665
Microsoft Windows Server 2025<10.0.26100.4270
Microsoft Windows Server 2012 R2<6.3.9600.22620, <1
6.3.9600.226201
Microsoft Windows Server 2008<6.0.6003.23351, <1
6.0.6003.233511
Microsoft Windows Server 2012 R2<6.3.9600.22620, <1
6.3.9600.226201
Microsoft Windows Server 2008 R2<6.1.7601.27769, <1
6.1.7601.277691
Microsoft Windows Server 2008 R2<6.1.7601.27769, <1
6.1.7601.277691
Microsoft Windows Server 2008<6.0.6003.23351, <1
6.0.6003.233511
Microsoft Windows Server 2012<6.2.9200.25522, <1.000
6.2.9200.255221.000
Microsoft Windows Server 2012<6.2.9200.25522, <1.000
6.2.9200.255221.000
Microsoft Windows Server 2016<10.0.14393.8148
10.0.14393.8148
Microsoft Windows Server 2008<6.0.6003.23351, <1
6.0.6003.233511
Microsoft Windows Server 2016<10.0.14393.8148
10.0.14393.8148
Microsoft Windows Server 2008<6.0.6003.23351, <1
6.0.6003.233511
Microsoft Windows 10=1607
10.0.14393.8148
Microsoft Windows 10<10.0.10240.21034
10.0.10240.21034
Microsoft Windows 10=1607
10.0.14393.8148
Microsoft Windows 11=24H2
10.0.26100.434910.0.26100.4270
Microsoft Windows Server 2025<10.0.26100.4349, <10.0.26100.4270
10.0.26100.434910.0.26100.4270
Microsoft Windows 10<10.0.10240.21034
10.0.10240.21034
Microsoft Windows 11=24H2
10.0.26100.434910.0.26100.4270
Microsoft Windows Server 2022, 23H2 Edition<10.0.25398.1665
10.0.25398.1665
Microsoft Windows 11=23H2
10.0.22631.5472
Microsoft Windows Server 2025<10.0.26100.4349, <10.0.26100.4270
10.0.26100.434910.0.26100.4270
Microsoft Windows 11=23H2
10.0.22631.5472
Microsoft Windows 10=22H2
10.0.19045.5965
Microsoft Windows Server 2022<10.0.20348.3807, <10.0.20348.3745
10.0.20348.380710.0.20348.3745
Microsoft Windows 10=22H2
10.0.19045.5965
Microsoft Windows 10=22H2
10.0.19045.5965
Microsoft Windows 10=21H2
10.0.19044.5965
Microsoft Windows 11=22H2
10.0.22621.5472
Microsoft Windows 10=21H2
10.0.19044.5965
Microsoft Windows 11=22H2
10.0.22621.5472
Microsoft Windows 10=1809
10.0.17763.7434
Microsoft Windows Server 2019<10.0.17763.7434
10.0.17763.7434
Microsoft Windows 10=1809
10.0.17763.7434
Microsoft Windows Server 2019<10.0.17763.7434
10.0.17763.7434
Microsoft Windows Server 2022<10.0.20348.3807, <10.0.20348.3745
10.0.20348.380710.0.20348.3745
Microsoft Windows 10=21H2
10.0.19044.5965

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 6.3.9600.22620Fixed in 1Patch KB5060996
  2. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 6.1.7601.27769Fixed in 1Patch KB5060996
  3. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 6.0.6003.23351Fixed in 1Patch KB5060996
  4. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 6.2.9200.25522Fixed in 1.000Patch KB5060996
  5. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.14393.8148Patch KB5061010
  6. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.10240.21034Patch KB5060998
  7. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.26100.4349Fixed in 10.0.26100.4270Patch KB5060841
  8. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.25398.1665Patch KB5060118
  9. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.22631.5472Patch KB5060999
  10. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.19045.5965Patch KB5060533
  11. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.20348.3807Fixed in 10.0.20348.3745Patch KB5060525
  12. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.22621.5472Patch KB5060999
  13. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.19044.5965Patch KB5060533
  14. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.17763.7434Patch KB5060531
  15. Upgrade

    Upgrade Microsoft Windows to a version that resolves this vulnerability.

    Fixed in 10.0.10240.21034Patch KB5060998
  16. Upgrade

    Upgrade Microsoft Windows to a version that resolves this vulnerability.

    Fixed in 10.0.14393.8148Patch KB5061010
  17. Upgrade

    Upgrade Microsoft Windows to a version that resolves this vulnerability.

    Fixed in 10.0.17763.7434Patch KB5060531
  18. Upgrade

    Upgrade Microsoft Windows to a version that resolves this vulnerability.

    Fixed in 10.0.19044.5965Patch KB5060533
  19. Upgrade

    Upgrade Microsoft Windows to a version that resolves this vulnerability.

    Fixed in 10.0.19045.5965Patch KB5060533
  20. Upgrade

    Upgrade Microsoft Windows to a version that resolves this vulnerability.

    Fixed in 10.0.20348.3807Patch KB5060525
  21. Upgrade

    Upgrade Microsoft Windows to a version that resolves this vulnerability.

    Fixed in 10.0.20348.3745Patch KB5060525
  22. Upgrade

    Upgrade Microsoft Windows to a version that resolves this vulnerability.

    Fixed in 10.0.22621.5472Patch KB5060999
  23. Upgrade

    Upgrade Microsoft Windows to a version that resolves this vulnerability.

    Fixed in 10.0.22631.5472Patch KB5060999
  24. Upgrade

    Upgrade Microsoft Windows to a version that resolves this vulnerability.

    Fixed in 10.0.25398.1665Patch KB5060118
  25. Upgrade

    Upgrade Microsoft Windows to a version that resolves this vulnerability.

    Fixed in 10.0.26100.4349Patch KB5060841
  26. Upgrade

    Upgrade Microsoft Windows to a version that resolves this vulnerability.

    Fixed in 10.0.26100.4270Patch KB5060841
  27. Upgrade

    Upgrade Microsoft Windows to a version that resolves this vulnerability.

    Fixed in 6.0.6003.23351Patch KB5060996
  28. Upgrade

    Upgrade Microsoft Windows to a version that resolves this vulnerability.

    Fixed in 6.1.7601.27769Patch KB5060996
  29. Upgrade

    Upgrade Microsoft Windows to a version that resolves this vulnerability.

    Fixed in 6.2.9200.25522Patch KB5060996
  30. Upgrade

    Upgrade Microsoft Windows to a version that resolves this vulnerability.

    Fixed in 6.3.9600.22620Patch KB5060996
  31. Compensating control

    Follow applicable BOD 22-01 guidance for cloud services; discontinue use of the product if mitigations are unavailable.

Event History

Jun 10, 2025
CVE Published
via CISA·12:00 AM
Known Exploited
via CISA·12:00 AM
Data Sourced
via CISA·12:00 AM
RemedyDescriptionAffected Software
Data Sourced
via Microsoft·07:00 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·07:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
Description
CVE Published
via MITRE·05:02 PM
Data Sourced
via MITRE·05:02 PM
DescriptionSeverity
Data Sourced
via NVD·05:22 PM
DescriptionSeverityWeaknessAffected Software
News Published
via Dark Reading·09:56 PM
News Published
via The Register·11:38 PM
News Published
via The Register·11:44 PM
Jun 11, 2025
News Published
via ZDNet·02:51 PM
News Published
via ZDNet·02:59 PM
News Published
via BleepingComputer·03:47 PM
News Published
via BleepingComputer·03:49 PM
News Published
via ZDNet·07:01 PM
May 12, 2026
News Published
via Dark Reading·10:19 AM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-33053?

CVE-2025-33053 is considered a critical vulnerability due to its potential for remote code execution.

2

How do I fix CVE-2025-33053?

To fix CVE-2025-33053, apply the latest security updates provided by Microsoft for the affected products.

3

Which software is affected by CVE-2025-33053?

CVE-2025-33053 affects several Microsoft products including Windows Server 2019, Windows 10, Windows 11, and others.

4

What is the impact of CVE-2025-33053?

The impact of CVE-2025-33053 allows an unauthorized attacker to execute code over a network, potentially compromising the system.

5

Is there a workaround for CVE-2025-33053?

Currently, the recommended solution for CVE-2025-33053 is to apply the security updates, as there are no specific workarounds.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203