CVE-2025-21247: microsoft windows_10_1507 Improper Resolution of Path Equivalence

Vulnerability summary

CVE-2025-21247 is a medium (CVSS 4.3) Improper Resolution of Path Equivalence vulnerability in microsoft windows_10_1507. EPSS estimates a 3.05% chance of exploitation in the next 30 days, higher than 87.4% of scored vulnerabilities.

Timeline

1. 11-03-2025
   PublishedVulnerability first disclosed.
2. 13-02-2026
   Last modifiedVulnerability information updated.

Description

Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.

• CWE-41Improper Resolution of Path EquivalenceThe product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object.