Internet Shortcut Files Remote Code Execution Vulnerability
CVE-2025-33053 is a remote code execution vulnerability in Internet Shortcut Files (rated Important, CVSS 8.8). Microsoft reports that it is being exploited.
Exploited1 version
Facts
- Microsoft id
CVE-2025-33053- Status
- Exploited
- Products
- Internet Shortcut Files
- Severity
- Important
- Impact
- Remote Code Execution
- CVSS
- 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
- Exploited
- Yes
- Publicly disclosed
- No
- Exploitability
- Exploitation Detected
- Customer action required
- Yes
- Release
- 2025-Jun
- Assigned by
- Microsoft
- Weakness
- CWE-73: External Control of File Name or Path
- MSRC revision
- 1.1
- First captured by us
- (from our first import of this list)
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2025-06-10:
Information published.
- Revision 1.1, 2025-06-19:
Corrected the CVE description and title. This is an informational change only.
Microsoft says
External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
As first seen: Exploited
- Status
- Exploited
Seen by us · Microsoft's timestamp · Microsoft's page