Loading story…
Researchers disclosed a critical remote code execution issue in the Windows ms-officecmd: URI handler that let attackers inject arguments into Microsoft application launches through crafted JSON passed to LocalBridge.exe and AppBridge.dll. The flaw affected Windows 10 and 11 and could be used to start applications including Teams, Skype, and Outlook with attacker-controlled parameters, enabling arbitrary command execution, interception of Teams traffic, exposure of the Node.js debugger, and Outlook-assisted phishing scenarios.
The researchers reported that Internet Explorer 11 and Edge Legacy on Windows 10 could invoke the malicious URI without showing an external-protocol confirmation prompt, creating a drive-by exploitation path when Teams was installed and not already running. Microsoft initially dismissed the report, later reclassified it as Critical RCE, awarded a $5,000 bounty, and released a partial fix, but the researchers said the underlying argument-injection weakness remained present on fully patched Windows 10 and Windows 11 systems at the time of publication.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The reference set includes a CVE record for CVE-2020-13699, indicating the vulnerability had been formally cataloged under that identifier. No explicit event date is provided in the content.
The researchers said Microsoft released a partial mitigation that blocked some Teams and Skype exploitation paths. They also stated the underlying argument-injection flaw remained present on patched Windows 10 and Windows 11 systems.
According to the disclosure, Microsoft initially dismissed the report but later reclassified it as a Critical remote code execution issue and awarded a $5,000 bounty. The content does not explicitly state when that reclassification and payment occurred.
Positive Security disclosed a Windows 10/11 code execution issue in the default ms-officecmd: URI handler involving LocalBridge.exe and AppBridge.dll, showing crafted JSON payloads could inject arguments and launch Microsoft applications with attacker-controlled parameters. The disclosure described impacts including arbitrary command execution, Teams traffic interception, Node.js debugger exposure, and Outlook phishing paths.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed **CVE-2025-33053**, an **Important** remote code execution flaw in **Internet Shortcut Files** that affects all supported versions of Windows and carries a **CVSS 8.8** rating. The vulnerability is tied to **CWE-73** (external control of file name or path) and can let an unauthenticated attacker execute code over a network if a user clicks a specially crafted URL. Microsoft said the bug had been **exploited in the wild**, that **functional exploit code** was available, and that security updates had been released. The advisory said the issue has implications beyond legacy browser use because underlying **MSHTML**, **EdgeHTML**, and scripting components remain supported on some platforms and are still used by **Internet Explorer mode**, the **WebBrowser control**, **WebView**, and some **UWP** applications. Microsoft also noted that **IE cumulative updates** still matter for certain older Windows Server systems, and later revised the advisory to correct the CVE title and description without changing the technical impact. Related Microsoft advisories show the flaw joins a broader pattern of remote code execution risks across Windows and server products, including **MSHTML**, **Hyper-V**, **Exchange Server**, and **SharePoint Server**.
Jun 29, 2026
Microsoft Edge users faced a series of serious vulnerabilities spanning remote code execution, information disclosure, and legacy browser compatibility risks. Reported issues included `CVE-2025-59251`, an Edge remote code execution flaw with limited public technical detail; `CVE-2025-29834`, an out-of-bounds read in the V8 JavaScript engine affecting versions before `135.0.2789.91`; and `CVE-2025-49713`, a type confusion bug in V8 that reportedly enabled in-the-wild exploitation against Edge versions before `138.0.3351.65`. Separately, `CVE-2025-49741` was described as an information disclosure issue tied to improper validation of the `x-middleware-subrequest` HTTP header, potentially exposing cached data and session tokens in versions before `137.0.3296.62`. The disclosures also highlighted risk beyond standard browsing sessions. `CVE-2025-30397` affected Microsoft’s Scripting Engine when Edge was used in Internet Explorer Mode, creating an actively exploited path to remote code execution on Windows 10 and Windows 11 systems that still depend on legacy web applications. Microsoft issued updates across the affected products, while defenders were urged to prioritize browser patching, review exposure in Chromium-based deployments, harden JavaScript and web-content controls, and reduce or disable IE Mode where operationally possible. A new advisory from HKCERT on multiple Microsoft Edge vulnerabilities underscores the continuing volume of security issues affecting the browser.
Jun 29, 2026
Researchers published a detailed patch analysis and proof-of-concept exploit for **CVE-2016-0189**, a VBScript engine memory corruption flaw in **Internet Explorer 11** that had already been used in targeted attacks in South Korea. The analysis of Microsoft bulletin **MS16-051** found two patched issues in `vbscript.dll`: a missing `SafeArray` lock in the `AccessArray` function that can enable out-of-bounds read/write during array resizing, and an `IsUnsafeAllowed` logic flaw that bypasses VBScript safety checks. Chaining the bugs allows arbitrary memory read/write and modification of `COleScript` safety settings to enable unsafe script execution in IE11 on Windows 10. The accompanying GitHub repository released a public exploit for Windows 10 and IE11, lowering the barrier to reproducing the attack path. The researchers noted the exploit was not fully reliable and might require repeated page loads, but showed how the vulnerability could still be leveraged despite Internet Explorer Protected Mode. Their write-up also described using a localhost/Intranet trust-based technique, previously documented by Zero Day Initiative, to move from a Protected Mode context toward **Medium integrity** code execution.
Jul 24, 2026