VulnSocial

CVE-2025-24071Disclosure(microsoft / windows_10_1507)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.

microsoft CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Vendor / third-party advisories
Weakness type (CWE)
CWE-200

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • windows_10_1507
  • windows_10_1607
  • windows_10_1809
  • windows_11_23h2

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-09-13); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
microsoft
Products
windows_10_1507windows_10_1607windows_10_1809windows_11_23h2windows_11_24h2windows_server_2012windows_server_2016windows_server_2019windows_server_2022windows_server_2022_23h2

1 version affected across 11 products

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-13: 1Mentions · 2026-10-26: 1Technical Details · 2026-09-13: 1Technical Details · 2026-10-26: 109-1310-26
Signal classification1 categories
Disclosure
2100.0%
Referenced assets1 URL
Full discourse2 posts
  • Dark Web Informer@DarkWebInformer
    Disclosure

    CVE-2025-24071: Simply extracting a .rar archive containing a malicious .library-ms file can cause Windows Explorer to initiate an outbound SMB authentication request, potentially exposing the user's NTLM hash. No further interaction is required after extraction. https://t.co/NdXWN2YdoH

    Post summary

    The text announces CVE-2025-24071, detailing a vulnerability where extracting a malicious .rar archive triggers Windows Explorer to initiate outbound SMB authentication, potentially exposing NTLM hashes. It provides technical details of the flaw but contains no evidence of active exploitation, PoC code, named exploits, or available patches.

    62011506415.7K
    251.6K followersView on X
  • cybrmonk@cybr_monk
    Disclosure

    CVE-2025-24071 Lets Attackers Spoof Network Traffic via Windows File Explorer https://cybrmonk.com/blog/cve-2025-24071-lets-attackers-spoof-network-traffic-via-windows-file-explorer #cybersecurity #threatintelligence https://t.co/BhH2ierEmZ

    Post summary

    The text announces the discovery of CVE‑2025‑24071, which allows attackers to spoof network traffic through Windows File Explorer, but it does not provide a PoC, exploit details, or patch information.

    0000046
    47 followersView on X
CPE platform detail15 entries

15 of 15 entries

PartVendorProductVersionTarget SWTarget HW
OSmicrosoftwindows_10_1507--x64
OSmicrosoftwindows_10_1507--x86
OSmicrosoftwindows_10_1607--x64
OSmicrosoftwindows_10_1607--x86
OSmicrosoftwindows_10_1809--x64
OSmicrosoftwindows_10_1809--x86
OSmicrosoftwindows_11_23h2---
OSmicrosoftwindows_11_24h2--arm64
OSmicrosoftwindows_11_24h2--x64
OSmicrosoftwindows_server_2012r2--
OSmicrosoftwindows_server_2016---
OSmicrosoftwindows_server_2019---
OSmicrosoftwindows_server_2022---
OSmicrosoftwindows_server_2022_23h2--x64
OSmicrosoftwindows_server_2025--x64

Explore more

Back to dashboardmicrosoft CVEswindows_10_1507 vulnerabilities