Multiple vulnerabilities in Microsoft Internet Explorer MapUrlToZone security feature

1) Improper Resolution of Path Equivalence

EUVDB-ID: #VU102636

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21268

CWE-ID: CWE-41 - Improper Resolution of Path Equivalence

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper resolution of path equivalence in MapUrlToZone security feature. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Microsoft Internet Explorer: 11 - 11.1790.17763.0

Windows Server: before 2008 R2 6.1.7601.27520, 2008 6.0.6003.23070, 2012 R2 6.3.9600.22371, 2012 6.2.9200.25273, 2022 10.0.20348.3091, 2022 23H2 10.0.25398.1369, 2025 10.0.26100.2894, 2008 R2 6.1.7601.27520, 2008 R2 6.1.7601.27520, 2008 R2 6.1.7601.27520

Windows: before 10 21H2 10.0.19044.5371, 10 22H2 10.0.19045.5371, 10 1507 10.0.10240.20890, 10 1607 10.0.14393.7699, 10 1809 10.0.17763.6775, 11 22H2 10.0.22621.4751, 11 23H2 10.0.22631.4751, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371

CPE2.3

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-21268

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper Resolution of Path Equivalence

EUVDB-ID: #VU102644

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21189

CWE-ID: CWE-41 - Improper Resolution of Path Equivalence

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper resolution of path equivalence in MapUrlToZone security feature. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Microsoft Internet Explorer: 11 - 11.1790.17763.0

Windows: before 10 21H2 10.0.19044.5371, 10 22H2 10.0.19045.5371, 10 1507 10.0.10240.20890, 10 1607 10.0.14393.7699, 10 1809 10.0.17763.6775, 11 22H2 10.0.22621.4751, 11 23H2 10.0.22631.4751, 11 24H2 10.0.26100.2894, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371

Windows Server: before 2008 R2 6.1.7601.27520, 2008 6.0.6003.23070, 2012 R2 6.3.9600.22371, 2012 6.2.9200.25273, 2016 10.0.14393.7699, 2022 10.0.20348.3091, 2022 23H2 10.0.25398.1369, 2008 R2 6.1.7601.27520, 2008 R2 6.1.7601.27520, 2008 R2 6.1.7601.27520

CPE2.3

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-21189

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper Resolution of Path Equivalence

EUVDB-ID: #VU102645

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21332

CWE-ID: CWE-41 - Improper Resolution of Path Equivalence

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper resolution of path equivalence in MapUrlToZone security feature. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Microsoft Internet Explorer: 11 - 11.1790.17763.0

Windows Server: before 2008 R2 6.1.7601.27520, 2008 6.0.6003.23070, 2012 R2 6.3.9600.22371, 2012 6.2.9200.25273, 2016 10.0.14393.7699, 2022 10.0.20348.3091, 2022 23H2 10.0.25398.1369, 2025 10.0.26100.2894, 2008 R2 6.1.7601.27520, 2008 R2 6.1.7601.27520, 2008 R2 6.1.7601.27520, 2008 R2 6.1.7601.27520

Windows: before 10 21H2 10.0.19044.5371, 10 22H2 10.0.19045.5371, 10 1507 10.0.10240.20890, 10 1607 10.0.14393.7699, 10 1809 10.0.17763.6775, 11 22H2 10.0.22621.4751, 11 23H2 10.0.22631.4751, 11 24H2 10.0.26100.2894, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371

CPE2.3

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-21332

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Integer underflow

EUVDB-ID: #VU102649

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21276

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to integer underflow when handling HTML content in MapUrlToZone security feature. A remote attacker can trick the victim into opening a specially crafted HTML file, trigger an integer underflow and crash the browser.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Microsoft Internet Explorer: 11 - 11.1790.17763.0

Windows Server: before 2008 R2 6.1.7601.27520, 2008 6.0.6003.23070, 2012 R2 6.3.9600.22371, 2012 6.2.9200.25273, 2016 10.0.14393.7699, 2022 10.0.20348.3091, 2022 23H2 10.0.25398.1369, 2025 10.0.26100.2894, 2008 R2 6.1.7601.27520, 2008 R2 6.1.7601.27520, 2008 R2 6.1.7601.27520, 2008 R2 6.1.7601.27520

Windows: before 10 21H2 10.0.19044.5371, 10 22H2 10.0.19045.5371, 10 1507 10.0.10240.20890, 10 1607 10.0.14393.7699, 10 1809 10.0.17763.6775, 11 22H2 10.0.22621.4751, 11 23H2 10.0.22631.4751, 11 24H2 10.0.26100.2894, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371, 10 21H2 10.0.19044.5371

CPE2.3

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-21276

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Low
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2025-21268 CVE-2025-21189 CVE-2025-21332 CVE-2025-21276
CWE-ID	CWE-41 CWE-191
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Microsoft Internet Explorer Client/Desktop applications / Web browsers Windows Server Operating systems & Components / Operating system Windows Operating systems & Components / Operating system
Vendor	Microsoft