CVE-2025-33073

Name of the Vulnerable Software and Affected Versions Microsoft Windows (affected versions not specified)

Description Improper access control in the Windows SMB client, specifically within the mrxsmb.sys driver, allows an authorized or unauthenticated remote attacker to elevate privileges to the NT AUTHORITYSYSTEM level. The issue stems from flaws in authentication reflection, where attackers can use authentication coercion techniques—such as forcing a request to a UNC path—to trick a Windows host into connecting to a malicious system. By manipulating the CREDENTIAL TARGET INFORMATIONW structure and forcing the use of Kerberos over NTLM, an attacker can reflect a Kerberos ticket back to the same host. This process allows the attacker to establish an SMB session as the computer account (DOMAINMACHINE$) and subsequently gain full system control. This flaw can be exploited via standard RPC and SMB services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.