CVE-2025-33053

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-73

Affected software

No affected versions have been published.

Timeline

Published
Jun 10, 2025
Last modified
Jun 17, 2026
Added to CISA KEV
Jun 10, 2025
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-330548.1Insufficient UI warning of dangerous operations in Remote Desktop Client allows an unauthorized attacker to perform spoofing over a network.CVE-2025-330555.5Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.CVE-2025-330567.5Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an unauthorized attacker to deny service over a networkCVE-2025-330576.5Null pointer dereference in Windows Local Security Authority (LSA) allows an authorized attacker to deny service over a network.CVE-2025-330585.5Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.CVE-2025-330595.5Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.CVE-2025-33069.8A vulnerability was found in code-projects Blood Bank Management System 1.0 and classified as critical. This issue affects some unknown procCVE-2025-330605.5Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.CVE-2025-330615.5Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.CVE-2025-330625.5Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.CVE-2025-330635.5Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.CVE-2025-330648.8Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.
CVE-2025-33053: High severity, CVSS 8.8 | Vulnix