Loading story…
Small HTTP Server 3.06.36 by Smallsrv contains high-severity Windows service path vulnerabilities tracked as CVE-2025-41368 and CVE-2025-41359. Both advisories describe an unquoted service path affecting the executable configuration C:\Program Files (x86)\shttps_mg\http.exe service, which can cause Windows to resolve and launch an attacker-controlled executable from a higher-priority path location instead of the intended service binary.
A successful attack requires local access but could lead to arbitrary code execution, unauthorized system access, or service disruption if a malicious file is planted in the path searched by the service. The published mitigations call for properly quoting the Windows service path, applying available security updates, and restricting physical and network access to affected systems.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Two high-severity CVEs, CVE-2025-41359 and CVE-2025-41368, were published for Small HTTP Server 3.06.36. The flaws stem from the unquoted Windows service path 'C:\Program Files (x86)\shttps_mg\http.exe service', which could allow a local attacker to achieve arbitrary code execution, unauthorized access, or service disruption.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Newly documented vulnerabilities in **Spy Emergency build 23.0.205** and **sheed AntiVirus 2.3** allow local attackers to escalate privileges to **`LocalSystem`** through **unquoted service path** flaws classified as **`CWE-428`**. The affected services are **`SpyEmrgHealth`** and **`SpyEmrgSrv`** in Spy Emergency, and **`ShavProt`** in sheed AntiVirus. In each case, a low-privileged user can place a malicious executable in a path segment that Windows may incorrectly parse because the service executable path is not enclosed in quotes. If the vulnerable service is restarted or the host is rebooted, Windows can execute the attacker-controlled binary with **SYSTEM-level** privileges, creating a high-impact local privilege escalation path affecting confidentiality, integrity, and availability. The issues are tracked as **`CVE-2016-20056`** for Spy Emergency and **`CVE-2016-20061`** for sheed AntiVirus, with both records referencing vendor resources, **Exploit-DB**, and **VulnCheck** advisories.
Jun 29, 2026
Newly published CVEs detail **unquoted service path** vulnerabilities in two IObit products that can let a low-privileged local attacker gain **`LocalSystem`** execution. **CVE-2016-20055** affects **IObit Advanced SystemCare 10.0.2**, specifically the `AdvancedSystemCareService10` service, while **CVE-2016-20059** affects **IObit Malware Fighter 4.3.1** through the `IMFservice` and `LiveUpdateSvc` services. Both issues are classified as **CWE-428** and carry high-severity CVSS v3.1 and v4.0 ratings reflecting potential impact to confidentiality, integrity, and availability. In both cases, an attacker with local access can place a malicious executable in a vulnerable service path and wait for the affected service to restart or for the system to reboot, at which point the payload may run with elevated privileges. The Malware Fighter entry cites supporting references including IObit product pages, an **Exploit-DB** listing, and a **VulnCheck** advisory, while both CVEs were recorded through disclosures submitted to **disclosure@vulncheck.com**.
Jun 29, 2026
Microsoft disclosed **CVE-2025-33053**, an **Important** remote code execution flaw in **Internet Shortcut Files** that affects all supported versions of Windows and carries a **CVSS 8.8** rating. The vulnerability is tied to **CWE-73** (external control of file name or path) and can let an unauthenticated attacker execute code over a network if a user clicks a specially crafted URL. Microsoft said the bug had been **exploited in the wild**, that **functional exploit code** was available, and that security updates had been released. The advisory said the issue has implications beyond legacy browser use because underlying **MSHTML**, **EdgeHTML**, and scripting components remain supported on some platforms and are still used by **Internet Explorer mode**, the **WebBrowser control**, **WebView**, and some **UWP** applications. Microsoft also noted that **IE cumulative updates** still matter for certain older Windows Server systems, and later revised the advisory to correct the CVE title and description without changing the technical impact. Related Microsoft advisories show the flaw joins a broader pattern of remote code execution risks across Windows and server products, including **MSHTML**, **Hyper-V**, **Exchange Server**, and **SharePoint Server**.
Jun 29, 2026