On 10 June 2025, Microsoft released its June 2025 security update, addressing 66 newly disclosed vulnerabilities. Arctic Wolf has highlighted five of these vulnerabilities in this security bulletin due to their potential impact.
Vulnerabilities
| Vulnerability | CVSS | Description | Exploited? |
| CVE-2025-33053 | 8.8 | Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution Vulnerability – A remote threat actor can exploit this vulnerability to execute code over the network by leveraging external control of file name or path in WebDAV. WebDAV is a protocol that allows users to remotely manage and edit files on web servers.
|
Yes |
| CVE-2025-47162 | 8.4 | Microsoft Office Remote Code Execution Vulnerability – A heap-based buffer overflow flaw in Microsoft Office that allows unauthorised threat actors to execute code locally. Although the threat actor may be remote, exploitation requires code execution on the local machine. | No |
| CVE-2025-47164 | 8.4 | Microsoft Office Remote Code Execution Vulnerability – A use after free (UAF) flaw in Microsoft Office that allows unauthorised threat actors to execute code locally. Although the threat actor may be remote, exploitation requires code execution on the local machine. | No |
| CVE-2025-47167 | 8.4 | Microsoft Office Remote Code Execution Vulnerability – A type confusion flaw in Microsoft Office that allows unauthorised threat actors to execute code locally. Although the threat actor may be remote, exploitation requires code execution on the local machine. | No |
| CVE-2025-33073 | 8.8 | Windows SMB (Server Message Block) Client Elevation of Privilege Vulnerability – A remote threat actor can exploit this vulnerability by executing a specially crafted script to coerce a victim machine into connecting to a malicious SMB server and authenticating, potentially leading to elevation of privilege.
|
No |
Recommendation
Upgrade to Latest Fixed Versions
Arctic Wolf strongly recommends that customers upgrade to the latest fixed versions.
| Affected Product | CVE | Update Article |
| Windows Server 2025 | CVE-2025-33053, CVE-2025-33073 | 5060842, 5060841 |
| Windows Server 2022, 23H2 Edition (Server Core installation) | CVE-2025-33053, CVE-2025-33073 | 5060118 |
| Windows Server 2022 | CVE-2025-33053, CVE-2025-33073 | 5060526, 5060525 |
| Windows Server 2019 | CVE-2025-33053, CVE-2025-33073 | 5060531, 5061010 |
| Windows Server 2016 | CVE-2025-33073 | 5061010 |
| Windows Server 2012 R2 | CVE-2025-33053, CVE-2025-33073 | 5061018, 5060996 |
| Windows Server 2012 | CVE-2025-33053, CVE-2025-33073 | 5061059, 5060996 |
| Windows Server 2008 R2 for x64-based Systems Service Pack 1 | CVE-2025-33053, CVE-2025-33073 | 5061078, 5060996, 5061036 |
| Windows Server 2008 for 32-bit, and x64-based Systems Service Pack 2 | CVE-2025-33053, CVE-2025-33073 | 5061026, 5060996, 5061072 |
| Windows 11 Version 24H2 for x64-based, and ARM64-based Systems | CVE-2025-33053, CVE-2025-33073 | 5060842, 5060841 |
| Windows 11 Version 23H2 for x64-based, and ARM64-based Systems | CVE-2025-33053, CVE-2025-33073 | 5060999 |
| Windows 11 Version 22H2 for x64-based, and ARM64-based Systems | CVE-2025-33053, CVE-2025-33073 | 5060999 |
| Windows 10 Version 22H2 for 32-bit, x64-based, and ARM64-based Systems | CVE-2025-33053, CVE-2025-33073 | 5060533 |
| Windows 10 Version 21H2 for 32-bit, x64-based, and ARM64-based Systems | CVE-2025-33053, CVE-2025-33073 | 5060533 |
| Windows 10 Version 1809 for 32-bit, and x64-based Systems | CVE-2025-33053, CVE-2025-33073 | 5060531 |
| Windows 10 Version 1607 for 32-bit, and x64-based Systems | CVE-2025-33053, CVE-2025-33073 | 5061010 |
| Windows 10 for 32-bit, and x64-based Systems | CVE-2025-33053, CVE-2025-33073 | 5060998 |
| Microsoft Office LTSC for Mac 2024 | CVE-2025-47162, CVE-2025-47164, CVE-2025-47167 | Release Notes |
| Microsoft Office LTSC for Mac 2021 | CVE-2025-47162, CVE-2025-47164, CVE-2025-47167 | Release Notes |
| Microsoft Office LTSC 2024 for 32-bit, and 64-bit editions | CVE-2025-47162, CVE-2025-47164, CVE-2025-47167 | Click to Run |
| Microsoft Office LTSC 2021 for 32-bit, and 64-bit editions | CVE-2025-47162, CVE-2025-47164, CVE-2025-47167 | Click to Run |
| Microsoft Office for Android | CVE-2025-47162, CVE-2025-47164, CVE-2025-47167 | Release Notes |
| Microsoft Office 2019 for 32-bit, and 64-bit editions | CVE-2025-47162, CVE-2025-47164, CVE-2025-47167 | Click to Run |
| Microsoft Office 2016 32-bit, and 64-bit editions | CVE-2025-47162, CVE-2025-47164, CVE-2025-47167 | 5002730, 5002616 |
| Microsoft 365 Apps for Enterprise for 32-bit, and 64-bit Systems | CVE-2025-47162, CVE-2025-47164, CVE-2025-47167 | Click to Run |
Please follow your organisation’s patching and testing guidelines to minimise potential operational impact.
References
Resources
