Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to intelligence
endpoint-software-vulnerabilitywidely-deployed-product-advisory

Microsoft Discloses Windows RCE Flaws in Scripting Languages and URL Parsing

Updated 28d agoFirst seen May 25, 20262 sources

Microsoft published Security Update Guide entries for two Windows remote code execution vulnerabilities affecting different core components: CVE-2022-41118 in Windows Scripting Languages and CVE-2025-59295 in Windows URL Parsing. Both advisories classify the issues as remote code execution flaws, indicating that successful exploitation could allow an attacker to run arbitrary code on a targeted Windows system.

The disclosures point to risk across widely used Windows functionality rather than a single application, underscoring the need for defenders to review affected product versions and apply Microsoft-issued updates through normal patch management channels. The vulnerabilities are tracked under the identifiers CVE-2022-41118 and CVE-2025-59295, with Microsoft maintaining the authoritative remediation details in its Security Update Guide.

Share:
Microsoft Discloses Windows RCE Flaws in Scripting Languages and URL Parsing
Stay ahead

Get ahead of threats like this

Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.

Start free trial
EVENT TIMELINE

How this story unfolded

2 events from the most recent confirmed update back to the earliest known activity.

2 EVENTS
Oct 14, 20258mo ago

Microsoft publishes advisory for CVE-2025-59295

Microsoft added CVE-2025-59295 to its Security Update Guide as a Windows URL Parsing Remote Code Execution Vulnerability.

Nov 8, 20224y ago

Microsoft publishes advisory for CVE-2022-41118

Microsoft added CVE-2022-41118 to its Security Update Guide as a Windows Scripting Languages Remote Code Execution Vulnerability.

SOURCE COVERAGE

Sources

2 references tracked. Mallory keeps watching after this page renders.

2 SOURCESView all
The operational view lives in Mallory

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t — which of your assets are affected, which threat actors are using it right now, which detections to deploy, and what to do next.
Start free trial
Exposure mapping

Map indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidence

Every observed campaign, victim, and pivot linked to actors named in this story.

Associated malware

Malware, exploits, and IOCs connected to the activity described here.

Detection signatures

YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alerts

Get matching new stories delivered to your team as they break — not the next morning.

AI threads

Ask questions about this story and take action on the answers.