CVE-2025-21301: Windows 10 1507 Geolocation Information Disclosure

CVE-2025-21301 Overview

CVE-2025-21301 is an information disclosure vulnerability in the Windows Geolocation Service. Microsoft assigned the flaw a CVSS 3.1 base score of 6.5 and classified it under improper access control [CWE-284]. An authenticated attacker with low privileges on the network can retrieve sensitive information exposed by the service without user interaction.

The vulnerability affects a broad range of client and server versions, from Windows 10 1507 through Windows 11 24H2 and from Windows Server 2016 through Windows Server 2025. Microsoft published the advisory on January 14, 2025.

Critical Impact
A low-privileged network-adjacent attacker can access confidential data handled by the Windows Geolocation Service, potentially exposing location telemetry and related system information.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-01-14 - CVE-2025-21301 published to NVD
2025-01-14 - Microsoft released security update guidance
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21301

Vulnerability Analysis

The Windows Geolocation Service brokers device location data to applications and system components. This flaw allows a low-privileged authenticated attacker to obtain information the service should keep protected. NVD categorizes the weakness as Improper Access Control [CWE-284], indicating the component fails to enforce authorization boundaries on certain data paths.

Successful exploitation results in confidentiality loss without impacting integrity or availability. The attack requires network access and valid credentials but no user interaction, which lowers the barrier for lateral movement scenarios inside a compromised environment.

Microsoft has not published exploitation details in the public advisory. No proof-of-concept code is available in Exploit-DB, and CISA has not added the CVE to the Known Exploited Vulnerabilities catalog. The EPSS model places the exploitation probability in the 73rd percentile, indicating moderate attention from vulnerability trackers.

Root Cause

The root cause is improper access control within the Geolocation Service component that handles location and related telemetry requests. The service does not sufficiently validate the caller's authorization before returning specific information objects, enabling disclosure to accounts that should not have visibility into that data.

Attack Vector

Exploitation requires network reachability to the affected Windows system and a valid low-privileged account. An attacker interacts with the Geolocation Service through its exposed interfaces to request data that would normally be restricted. Because the flaw does not require user interaction, adversaries can weaponize it inside automated post-compromise tooling for reconnaissance and privilege abuse workflows.

See the Microsoft CVE-2025-21301 Update Guide for the authoritative technical description.

Detection Methods for CVE-2025-21301

Indicators of Compromise

Anomalous queries to the Windows Geolocation Service (lfsvc) from low-privileged user contexts.
Unexpected inter-process communication with the Geolocation Service from non-location-aware applications.
Repeated location API access originating from remote sessions or service accounts.

Detection Strategies

Audit process access to lfsvc.dll and the Geolocation Service host process for callers outside known application baselines.
Correlate Windows Event Log entries for authentication events with subsequent Geolocation Service invocations from the same session.
Monitor Windows Location Framework logs for unusual data retrieval patterns.

Monitoring Recommendations

Ingest endpoint telemetry into a SIEM and alert on abnormal Geolocation Service consumers.
Track privilege usage for accounts that trigger location APIs but have no operational need for location data.
Review installed KB update inventory across all Windows client and server assets to confirm patch coverage.

How to Mitigate CVE-2025-21301

Immediate Actions Required

Apply the January 2025 Microsoft security updates listed in the Microsoft CVE-2025-21301 Update Guide to all affected Windows client and server systems.
Prioritize patching on multi-user systems, jump hosts, and terminal servers where low-privileged accounts routinely authenticate.
Review Geolocation Service exposure on servers that do not require location functionality.

Patch Information

Microsoft released fixes on January 14, 2025 through the standard Patch Tuesday cumulative updates. Consult the vendor update guide for the specific KB article per Windows version and install through Windows Update, WSUS, Microsoft Update Catalog, or Intune.

Workarounds

Disable the Windows Geolocation Service (lfsvc) on systems where location functionality is not required.
Restrict location access through Group Policy: Computer Configuration\Administrative Templates\Windows Components\Location and Sensors.
Limit interactive logon rights for low-privileged accounts on systems where the service must remain enabled.

bash

# Disable the Windows Geolocation Service where not required
sc.exe config lfsvc start= disabled
sc.exe stop lfsvc

# Group Policy setting to turn off location
# Computer Configuration > Administrative Templates > Windows Components >
# Location and Sensors > Turn off location = Enabled