Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes
Researchers found an unpatched Windows `search:` URI flaw that can leak NTLMv2 hashes over SMB, enabling relay attacks.
Intelligence analysis by GPT-5.4 Mini
Huntress says Windows' `search:` URI handler can be abused like a prior Snipping Tool bug: a crafted link can trigger an SMB connection and leak a user's NTLMv2 hash. Microsoft declined to patch it after disclosure, so defenders are told to block SMB where possible and harden NTLM.
A web link can trick a Windows computer into talking to a bad computer on the network. During that call, the computer may hand over a secret code, like showing a locker key to the wrong person.
Analysis
What happened
Huntress researchers disclosed an unpatched issue in Windows' search: URI handler that can expose a user's NTLMv2 hash. The behavior mirrors an earlier Windows Snipping Tool problem: a specially crafted link can make the machine reach out to an attacker-controlled SMB server, which then captures the authentication exchange.
The article says the issue uses search: with crumb=location: instead of the filePath parameter involved in CVE-2026-33829. According to Huntress researcher Andrew Schwartz, the flaw uses the same leakage mechanism, produces the same Net-NTLMv2 leak, requires the same user interaction, and carries the same Moderate rating.
The story also notes that a similar crumb-based technique had already been documented by Varonis in February 2024 under CVE-2023-35636. In practical terms, this means the attack is not new as a concept, but the URI handler being abused is different.
Response and mitigation
Microsoft reportedly declined to service the issue after responsible disclosure on April 15, 2026, saying only Important and Critical cases meet its bar for servicing. In the absence of a patch, the article recommends blocking outbound SMB on hosts that do not need it, enforcing SMB signing so leaked hashes cannot be relayed easily, and disabling NTLM where possible.
The core risk is not just hash exposure by itself. The danger comes when an attacker can reuse the captured credentials to authenticate elsewhere inside the network.
Key points
- Huntress disclosed an unpatched Windows `search:` URI issue that can leak NTLMv2 hashes.
- The attack can force a connection to an attacker-controlled SMB server and expose Net-NTLMv2 credentials.
- Microsoft declined to service the flaw, saying only Important and Critical issues meet its bar.
- The article recommends blocking outbound SMB, enforcing SMB signing, and disabling NTLM where possible.
- A similar `crumb`-based leak was previously documented in another Windows URI handling issue.
If organizations block outbound SMB where it is unnecessary, enforce SMB signing, and reduce NTLM use, the attack path becomes much harder to abuse. Those controls can limit both hash theft and later relay attacks.
Without a patch, users can still be lured into triggering the leak through a crafted link. If defenders leave SMB open or rely on NTLM, stolen hashes may be reused to gain deeper access inside the network.
