SB2025011447 - Multiple vulnerabilities in Microsoft Internet Explorer MapUrlToZone security feature

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Improper Resolution of Path Equivalence (CVE-ID: CVE-2025-21268)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper resolution of path equivalence in MapUrlToZone security feature. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

2) Improper Resolution of Path Equivalence (CVE-ID: CVE-2025-21189)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper resolution of path equivalence in MapUrlToZone security feature. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

3) Improper Resolution of Path Equivalence (CVE-ID: CVE-2025-21332)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper resolution of path equivalence in MapUrlToZone security feature. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

4) Integer underflow (CVE-ID: CVE-2025-21276)

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to integer underflow when handling HTML content in MapUrlToZone security feature. A remote attacker can trick the victim into opening a specially crafted HTML file, trigger an integer underflow and crash the browser.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-21268
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-21189
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-21332
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-21276