CVE-2025-59208CWE-125

Windows MapUrlToZone Information Disclosure Vulnerability

High · published October 14, 2025

CVSS v3.1
7.1
EPSS
0%
Percentile
41.9
In the wild
Unconfirmed
What it is

⚡ An unauthorized attacker can exploit an out-of-bounds read in Windows MapUrlToZone to sneakily disclose sensitive information over the network! Think of it as a waiter bringing you a menu but slipping in a secret note from the kitchen that reveals everyone’s order—information you shouldn't have access to! This vulnerability allows attackers to peek into data they shouldn’t be able to see. This could lead to the disclosure of sensitive information, potentially allowing an attacker to gather critical data about your network environment. It could expose personal, financial, or intellectual property details, making it a serious threat to your security.

Put simply

Think of it as a waiter bringing you a menu but slipping in a secret note from the kitchen that reveals everyone’s order—information you shouldn't have access to! This vulnerability allows attackers to peek into data they shouldn’t be able to see. This out-of-bounds read vulnerability occurs in the Windows MapUrlToZone function, enabling attackers to read memory locations they shouldn’t be able to access, potentially disclosing confidential information.

What to do

This could lead to the disclosure of sensitive information, potentially allowing an attacker to gather critical data about your network environment. It could expose personal, financial, or intellectual property details, making it a serious threat to your security. To remediate this vulnerability, ensure that you're running the latest version of Windows with security updates applied. Regularly audit your systems for unpatched vulnerabilities and implement proper network segmentation to limit exposure. You've got this! With a few updates, you'll be on your way to locking things down tight! 🛡️

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00499 · 41.9th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2025-10-14T17:01Z
EPSS history
Timeline
  • 14 OCT 17:01Z
    Windows MapUrlToZone Information Disclosure Vulnerability
    cvelistv5