EUVD-2025-17721
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Tags
Description
External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.
Analysis
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables remote code execution over a network. KEV-listed with EPSS 48.5% and public PoC, this vulnerability allows attackers to craft malicious .url files that execute arbitrary code when opened, bypassing the security restrictions normally applied to internet-sourced shortcut files.
Technical Context
Internet Shortcut (.url) files are simple text files that point to web resources. Windows handles them through the Shell, applying security checks based on the file's origin. This vulnerability allows attackers to manipulate the file path or name handling to bypass security restrictions (Mark of the Web, SmartScreen) and execute arbitrary code. The .url format is particularly dangerous because it's commonly shared via email and file shares, and users often trust shortcut files.
Affected Products
['Microsoft Windows 10', 'Microsoft Windows 11', 'Microsoft Windows Server (all supported versions)']
Remediation
Apply Microsoft security update. Block .url file attachments at email gateways. Educate users about shortcut file risks. Enable ASR rules for Shell-based attack prevention.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today