Microsoft fixes zero-day exploited for cyber espionage (CVE-2025-33053)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-3052 | An arbitrary write vulnerability in Microsoft signed UEFI firmware allows for code execution of untrusted software. An arbitrary write vulnerability in Microsoft signed UEFI firmware allows for code execution of untrusted software. This allows an attacker to control its value, leading to arbitrary memory writes, including modification of critical firmware settings stored in NVRAM. Exploiting this vulnerability could enable security bypasses, persistence mechanisms, or full system compromise. NVD description · AI analysis pending | 8.2 | <1% | — | — | ||
| CVE-2025-32717 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. NVD description · AI analysis pending | 8.4 | <1% |
| — | ||
| CVE-2025-33053 +1 in the same advisory: …33073 | Remote Code Execution in Microsoft Windows Internet Shortcut Files (CVE-2025-33053) CVE-2025-33053 is an external control of file name or path flaw (CWE-73) in how Windows processes Internet Shortcut (.url) files, allowing an unauthorized attacker to execute code over a network by making the shortcut resolve to an attacker-controlled path, such as a WebDAV share. Exploitation requires user interaction (CVSS vector UI:R): a user opening a crafted .url file, typically delivered via phishing, causes Windows to fetch and run content from the attacker-specified location, yielding remote code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8). All supported Windows 10 and Windows 11 client versions and Windows Server 2008, 2012, 2016, and 2019 are affected. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2025-06-10, Microsoft patched it in the June 2025 Patch Tuesday release, and Check Point research tied it to a cyber-espionage campaign by the Stealth Falcon actor against a major Turkish defense organization. EPSS estimates an 85.4% probability of exploitation within 30 days (100th percentile). Do: Apply Microsoft's June 2025 security updates to all affected Windows 10/11 clients and Windows Server 2008/2012/2016/2019 hosts, consistent with the KEV required action and BOD 22-01 timelines for federal agencies. Until patched, consider disabling the Windows WebDAV client where it is not needed and treat unsolicited .url shortcut files as untrusted; given confirmed espionage use, hunt for signs of exploitation on high-value endpoints. | 8.8 | 88% | KEV PoC ×3 |
| mass≈1 billion+ Windows devices (all listed Windows 10/11 client and mainstream Windows Server releases are affected) | |
| CVE-2025-33070 | Use of uninitialized resource in Windows Netlogon allows an unauthorized attacker to elevate privileges over a network. Use of uninitialized resource in Windows Netlogon allows an unauthorized attacker to elevate privileges over a network. NVD description · AI analysis pending | 8.1 | 7% |
| — | ||
| CVE-2025-33071 | Use after free in Windows KDC Proxy Service (KPSSVC) allows an unauthorized attacker to execute code over a network. Use after free in Windows KDC Proxy Service (KPSSVC) allows an unauthorized attacker to execute code over a network. NVD description · AI analysis pending | 8.1 | 18% |
| — | ||
| CVE-2025-47162 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. NVD description · AI analysis pending | 8.4 | <1% |
| — |
Full article873 words · extracted from helpnetsecurity.com · click to collapse
For June 2025 Patch Tuesday, Microsoft has fixed 66 new CVEs, including a zero-day exploited in the wild (CVE-2025-33053).
Also, Adobe Commerce and Magento Open Source users are urged to update quickly.
About CVE-2025-33053
CVE-2025-33053 is a remote code execution vulnerability in Web Distributed Authoring and Versioning (WebDAV), which is a protocol for extending HTTP protocol functionality for interacting with files.
Flagged by Check Point researchers, the vulnerability has been exploited in March 2025 to deliver a custom-built espionage tool (Horus Agent) to a major defense organization in Turkey, by an APT group known as Stealth Falcon.
“The attack began with what looked like a standard shortcut file — a .url file disguised as a PDF document related to military equipment damage,” the researchers shared.
The file was likely delivered via a phishing email and, once run, it would exploit the zero-day to execute malware from an actor-controlled WebDAV server.
“The attackers manipulated the Windows file execution search order. They tricked a built-in Windows utility into executing a malicious program hosted on their remote server,” the researchers explained.
“This technique allowed Stealth Falcon to run their code without needing to drop files on the first stage of the infection chain directly onto the victim’s computer. It also helped them evade detection by relying on legitimate, trusted Windows components to carry out the attack.”
And while WebDAV isn’t enabled by default (because it has been deprecated in 2023), Microsoft has nonetheless decided to patch the flaw in both newly released Windows and Windows Server versions and some legacy ones.
Other Microsoft patches
CVE-2025-33073, a vulnerability in the Windows SMB Client that could be used for privilege escalation if attackers can convince a victim to connect to an attacker controlled SMB server, is publicly disclosed but Microsoft says it’s less likely to be exploited.
Among the vulnerabilities that are more likely to be exploited are:
CVE-2025-33070, a Windows Netlogon that could allow attackers to gain domain administrator privileges by sending a specially crafted authentication requests to the domain controller
CVE-2025-47162, CVE-2025-47164 and CVE-2025-47167 – RCE flaws in Microsoft Office (that have yet to be fixed in Microsoft 365 Apps for Enterprise)
CVE-2025-32717, a Microsoft Word RCE vulnerability that could be exploited via a malicious RTF file, which the victim would open or just view in the preview pane
CVE-2025-33071, a use after free flaw in Windows KDC Proxy Service (KPSSVC), which could allow an unauthenticated attacker to execute code over a network.
As Rapid7 researchers explained, “The good news is that only Windows Server assets configured as a Kerberos Key Distribution Center Proxy Protocol server — happily, this is not enabled as standard configuration for a domain controller — and exploitation requires that the attacker win a race condition. The bad news is that Microsoft considers exploitation more likely regardless, and since a KDC proxy helps Kerberos requests from untrusted networks more easily access trusted assets without any need for a direct TCP connection from the client to the domain controller, the trade-off here is that the KDC proxy itself is quite likely to be exposed to an untrusted network.”
Microsoft has also addresed CVE-2025-3052, a memory corruption vulnerability in 14 modules signed with Microsoft’s third-party UEFI certificate, which could allow attackers to run unsigned code during the boot process (i.e., before the operating system loads) and install bootkits.
“This month, Microsoft did not patch BadSuccessor, a zero-day elevation of privilege vulnerability, despite its disclosure by researchers at Akamai on May 21 and the subsequent release of public proof-of-concepts, including a .NET implementation dubbed SharpSuccessor, and its inclusion in NetExec and BloodyAD,” noted Satnam Narang, senior staff research engineer at Tenable.
“BadSuccesor only affects domains that have at least one Windows Server 2025 domain controller, a rare configuration that we’ve observed in just 0.7% of AD domains based on a subset of our telemetry data. Nonetheless, we know that Microsoft intends to fix the flaw, but not this month. Organizations that do have at least one Windows Server 2025 domain controller should review permissions for principals and limit those permissions as much as possible.”
Adobe security updates
Adobe has released security updates for InCopy, Experience Manager, InDesign, Substance 3D Sampler, Substance 3D Painter, Acrobat Reader, Commerce and Magento Open Source, which fix a veritable avalanche (250+) of CVE-numbered flaws.
Among those updates, Adobe advises prioritizing the last one: while most of the five fixed vulnerabilities can be exploited only by attackers who have previously attained administrative privileges and while Adobe is not aware of any exploits in the wild for any of these issues, these vulnerabilities “have a higher risk of being targeted”. The company urged administrators to install the update within 72 hours.
UPDATE (June 16, 2025, 09:20 a.m. ET):
Synacktiv researchers have published a technical analysis of CVE-2025-33073.
“Even though CVE-2025-33073 is referred by Microsoft as a local privilege escalation (LPE), it is actually an authenticated remote command execution (RCE) as SYSTEM on any machine which does not enforce SMB signing,” noted cybersecurity engineer Alexandre Zanni.
Proof-of-concept scripts have also started appearing online.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2025/06/11/microsoft-fixes-zero-day-exploited-for-cyber-espionage-cve-2025-33053/