Windows Internet Shortcut Files Path Control Remote Code Execution Vulnerability (CVE-2025-33053, CISA KEV Actively Exploited)

1. Vulnerability Overview & Root Cause

CVE-2025-33053 is an external control of file name or path vulnerability (CWE-73) residing in the way Microsoft Windows processes Internet Shortcut (.url) files. The root cause lies in the insufficient validation of paths specified within the shortcut file parameters. When the Windows Shell parses a specially crafted .url file, it can be forced to resolve and access remote network paths (such as WebDAV or SMB shares) instead of local or trusted web resources, leading to unauthorized remote interaction.

2. Exploitation Mechanics & Attack Scenario

This vulnerability has been actively exploited in the wild as a zero-day by advanced threat actors (such as Stealth Falcon).

• Weaponization: The attacker crafts a malicious .url file where the target or icon path points to an attacker-controlled WebDAV server (e.g., \\attacker-ip\webdav\payload.dll).
• Delivery: The file is delivered to the target via spear-phishing emails, instant messengers, or malicious downloads.
• Execution: When the victim double-clicks the shortcut, or even simply browses the folder containing the file (triggering shell rendering/preview), Windows automatically initiates an outbound connection to the remote WebDAV server. This allows the attacker to bypass security boundaries and execute arbitrary code on the victim's machine.

3. Infrastructure & Business Impact

As a zero-day vulnerability listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, the risk to enterprise environments is critical. Successful exploitation grants the attacker initial access to the internal network, enabling credential theft, lateral movement, and deployment of ransomware or espionage malware, which can lead to catastrophic data breaches and operational downtime.