Second Windows URI Handler Bug Leaks NTLMv2 Hashes — Still Unpatched
Researchers flag a search: URI handler flaw that mirrors the recently patched ms-screensketch issue. Microsoft hasn't shipped a fix.
Another Windows URI handler is bleeding NTLMv2 hashes.
Researchers at Huntress disclosed an unpatched flaw in the search: URI handler that can be abused to coerce a victim's machine into authenticating to an attacker-controlled SMB endpoint, surrendering the NTLMv2 hash in the process. The bug follows the same pattern as CVE-2026-33829, the Snipping Tool ms-screensketch: URI handler spoofing vulnerability Microsoft patched recently.
Different handler. Same class of bug. No patch yet.
The mechanics are familiar to anyone who has tracked Windows NTLM coercion over the last decade. A crafted URI — delivered via phishing email, malicious document, or a drive-by link — invokes the registered protocol handler. The handler resolves a UNC path pointing at an attacker host. Windows obliges with an NTLM authentication exchange before anyone asks whether that was a good idea. The hash lands in the attacker's relay or cracking rig.
From there, the operational impact is the usual NTLM story: offline cracking against weak passwords, or live relay to services that still accept NTLM and don't enforce SMB signing or EPA (Extended Protection for Authentication). In an Active Directory environment with default settings, that's a lot of services.
Huntress credits its own research team with the discovery. The firm reports it disclosed the issue to Microsoft, and at time of writing no CVE has been assigned and no fix is available. Microsoft's standard position on NTLM coercion bugs has been inconsistent — some get CVEs and patches, others get classified as "by design" with a recommendation to disable NTLM or enforce SMB signing.
Mitigations defenders can apply now, without waiting on Redmond:
- Block outbound SMB (TCP 445) at the perimeter. This is table stakes in 2025 and still routinely missed on roaming laptops.
- Enforce SMB signing and turn on EPA for LDAP and other NTLM-accepting services.
- Configure the
RestrictSendingNTLMTrafficGroup Policy to audit, then deny, NTLM authentication to remote servers. - Consider Microsoft's broader push toward disabling NTLM entirely in favor of Kerberos and negotiate-only authentication.
The pattern here is worth flagging. Windows ships with a long tail of registered URI handlers, each one a potential coercion primitive if it touches the filesystem or network stack without sanitizing UNC paths. ms-screensketch: got patched. search: is the next domino. There will be more.
Until a fix lands, treat any inbound link or document that could trigger a custom protocol handler as suspect, and assume your endpoints will leak hashes if given the chance.
