CVE-2025-33071

—

CVSS 3.1

8.1 high

EPSS

18%p97

Published

Jun 10, 2025 (Jun 10, 2025)

Modified

Jun 17, 2026

Description

Use after free in Windows KDC Proxy Service (KPSSVC) allows an unauthorized attacker to execute code over a network.

Vendors: microsoft
Products: windows server 2012, windows server 2016, windows server 2019, windows server 2022, windows server 2022 23h2, windows server 2025
Weakness: CWE-416
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (17.9%)

In the news3 stories

Microsoft fixes zero-day exploited for cyber espionage (CVE-2025-33053)

Help Net SecurityJun 16, 13:26 UTC · Jun 16, 2025Exploit / PoC in the wildCVE-2025-33053 CVE-2025-33073 CVE-2025-33070+6 CVEs

60

Microsoft Patches 67 Vulnerabilities Including WEBDAV Zero

The Hacker NewsJun 12, 15:47 UTC · Jun 12, 2025Vulnerability in the wildCVE-2025-33053 CVE-2025-47966 CVE-2025-32713+3 CVEs1

60

Microsoft Patch Tuesday for June 2025 — Snort rules and prominent vulnerabilities

Cisco TalosJun 10, 21:45 UTC · Jun 10, 2025Vulnerability in the wildCVE-2025-32717 CVE-2025-32710 CVE-2025-29828+11 CVEs

60