CVE-2025-21197: Windows 10 1507 NTFS Information Disclosure

CVE-2025-21197 Overview

CVE-2025-21197 is an improper access control vulnerability in the Windows New Technology File System (NTFS) driver. An authorized attacker can disclose file path information located under a folder where the attacker lacks permission to list directory contents. The flaw undermines a core NTFS access control boundary by leaking metadata that should remain hidden from unauthorized users. Microsoft classifies this issue under CWE-284: Improper Access Control. The vulnerability affects a broad range of supported Windows client and server releases, from Windows 10 1507 through Windows 11 24H2 and Windows Server 2008 through Windows Server 2025.

Critical Impact
Authenticated attackers can enumerate file paths inside restricted directories, exposing sensitive filenames and directory structures that support follow-on targeted attacks.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-04-08 - CVE-2025-21197 published to the National Vulnerability Database
2025-04-08 - Microsoft releases security update guidance via MSRC
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21197

Vulnerability Analysis

The vulnerability resides in how NTFS enforces directory traversal and listing permissions. NTFS applies discretionary access control lists (DACLs) at each folder level, including the FILE_LIST_DIRECTORY right that governs whether a user can enumerate the contents of a directory. CVE-2025-21197 stems from a code path that allows an authenticated user to resolve or infer file paths under a directory where that right has been denied. The confidentiality impact is limited to path and filename metadata, but such metadata often reveals user identifiers, project code names, backup locations, and application internals. Attackers can chain this disclosure with other privilege escalation or credential attacks to accelerate lateral movement.

Root Cause

The root cause is improper access control [CWE-284] within an NTFS path resolution routine. The routine returns path information without verifying that the caller holds FILE_LIST_DIRECTORY on the parent folder. As a result, the enforcement of directory listing permissions is inconsistent with the enforcement of file open operations, creating an information disclosure channel.

Attack Vector

Exploitation requires an authenticated user with low privileges on a target Windows system or a network share it hosts. The attacker interacts with NTFS through standard Win32 or SMB file operations that reference paths under a restricted directory. By observing responses from these operations, the attacker infers filenames and folder structures that access control lists should have concealed. No user interaction is required, and the attack complexity is low. Public proof-of-concept code is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is approximately 2.947% (86th percentile), indicating measurable but not widespread exploit interest.

Detection Methods for CVE-2025-21197

Indicators of Compromise

Unusual bursts of file open, NtQueryDirectoryFile, or FindFirstFile/FindNextFile calls from a single low-privileged user against directories they cannot list.
SMB requests targeting restricted paths on file servers, accompanied by high volumes of STATUS_ACCESS_DENIED responses interleaved with successful path metadata replies.
Audit events from restricted directories showing repeated access attempts by non-privileged accounts.

Detection Strategies

Enable Windows object access auditing (Event IDs 4656, 4663, 4670) on sensitive NTFS directories and alert on high-volume access from non-administrative users.
Correlate file system telemetry with user role data to flag accounts probing directories outside their normal working set.
Hunt for scripted enumeration patterns invoking Get-ChildItem, dir, or robocopy against restricted paths, especially when launched from unusual parent processes.

Monitoring Recommendations

Ingest NTFS and SMB audit logs into a centralized analytics platform for behavioral baselining.
Establish a baseline of directory enumeration behavior per role and alert on statistical outliers.
Monitor for combinations of information disclosure activity followed by credential access or privilege escalation attempts on the same host.

How to Mitigate CVE-2025-21197

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft Security Update Guide for CVE-2025-21197 to all affected Windows client and server systems.
Prioritize patching on multi-user systems, file servers, terminal servers, and jump hosts where multiple low-privileged accounts share NTFS volumes.
Review DACLs on directories containing sensitive filenames and confirm that least-privilege principles are enforced.

Patch Information

Microsoft has released security updates addressing CVE-2025-21197 across all supported Windows versions listed in the affected products section. Refer to the Microsoft Security Update Guide CVE-2025-21197 advisory for the specific KB article that matches each Windows build. Apply the updates through Windows Update, Windows Server Update Services (WSUS), or your endpoint management platform.

Workarounds

Restrict interactive and network logon rights on sensitive file servers to only users who require access, reducing the pool of accounts that can trigger the flaw.
Segment sensitive datasets onto dedicated volumes or shares with tightly scoped access, so that path disclosure exposes fewer high-value assets.
Enforce naming conventions that avoid embedding secrets, project code names, or personally identifiable information in filenames on shared systems.

bash

# Configuration example: enable object access auditing on a restricted NTFS folder
auditpol /set /subcategory:"File System" /success:enable /failure:enable
icacls "C:\Restricted" /setaudit "Everyone:(OI)(CI)(RX,L)"