Microsoft fixes zero-day exploited for cyber espionage (CVE-2025-33053)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-3052 | An arbitrary write vulnerability in Microsoft signed UEFI firmware allows for code execution of untrusted software | 8.2 | <1% | ||
| CVE-2025-32717 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally | 8.4 | <1% | ||
CVE-2025-33053+1 related CVE | Remote Code Execution in Microsoft Windows Internet Shortcut Files (CVE-2025-33053) | 8.8 | 87% | KEVPoC ×3 | KEV |
| CVE-2025-33070 | Use of uninitialized resource in Windows Netlogon allows an unauthorized attacker to elevate privileges over a network | 8.1 | 7% | ||
| CVE-2025-33071 | Use after free in Windows KDC Proxy Service (KPSSVC) allows an unauthorized attacker to execute code over a network | 8.1 | 18% | ||
CVE-2025-47162+2 related CVEs | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally | 8.4 | <1% |
From the original article
4 min read at helpnetsecurity.com
For June 2025 Patch Tuesday, Microsoft has fixed 66 new CVEs, including a zero-day exploited in the wild (CVE-2025-33053). Also, Adobe Commerce and Magento Open Source users are urged to update quickly. CVE-2025-33053 is a remote code execution vulnerability in Web Distributed Authoring and Versioning (WebDAV), which is a protocol for extending HTTP protocol functionality for interacting with files.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.