Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes

An unpatched Windows Search URI handler vulnerability allows attackers to steal NTLMv2 hashes through crafted links.

• •The vulnerability uses unvalidated "search:" and "crumb=location:" parameters to redirect users to attacker-controlled SMB servers
• •NTLMv2 hashes exposed during the connection can be used to authenticate as the user or conduct relay attacks
• •Similar to the patched CVE-2026-33829 in Windows Snipping Tool, employing the same NTLM leakage mechanism
• •Microsoft declined to patch it, stating that only Critical and Important severity cases qualify for servicing
• •Mitigation strategies include blocking outbound SMB traffic (TCP/445, TCP/139), enforcing SMB signing, and disabling NTLM where possible

This summary was automatically generated by AI based on the original article and may not be fully accurate.