CVE-2025-21328: microsoft windows_10_1507 Improper Resolution of Path Equivalence

Vulnerability summary

CVE-2025-21328 is a medium (CVSS 4.3) Improper Resolution of Path Equivalence vulnerability in microsoft windows_10_1507. EPSS estimates a 1.49% chance of exploitation in the next 30 days, higher than 73.7% of scored vulnerabilities.

Timeline

1. 14-01-2025
   PublishedVulnerability first disclosed.
2. 09-06-2026
   Last modifiedVulnerability information updated.

Description

MapUrlToZone Security Feature Bypass Vulnerability

• CWE-41Improper Resolution of Path EquivalenceThe product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object.