Windows Search URI Handler Can Leak NTLM Hashes From a Single Click
Summary
A Huntress researcher found that a Windows search: URI can trigger an NTLMv2 hash leak with one click. Microsoft rated the issue Moderate but closed it without a CVE or fix; mitigations include blocking outbound SMB and restricting NTLM.
Key points
- The search: handler’s crumb=location: parameter can trigger an outbound SMB connection and expose a user’s Net-NTLMv2 hash.
- The researcher reproduced the issue on Windows 11 23H2 and 25H2; a link click in Edge triggered the leak without a prompt.
- The search: and search-ms: schemes use the same SearchExecute COM activation path in ExplorerFrame.dll.
- Microsoft closed the report as Moderate and below its servicing bar, with no CVE or patch; the researcher says the behavior resembles the patched Snipping Tool flaw CVE-2026-33829.
- Mitigations include blocking outbound SMB on TCP/445 and TCP/139, enforcing SMB signing, restricting NTLM where feasible, and alerting on search: and search-ms: URIs.
Article Details
- Attack Vectors
- A crafted search: URI containing crumb=location: with an attacker SMB UNC path can trigger outbound NTLM authentication and leak the victim's Net-NTLMv2 hash.
- The URI can be delivered through a link clicked in Microsoft Edge without a prompt; a command-line invocation is also demonstrated.
- The same underlying NTLM leakage behavior is reported for the search-ms: URI handler.
- Defensive Notes
- Block outbound SMB over TCP/445 and TCP/139 on hosts that do not require it.
- Enforce SMB signing to prevent captured hashes from being relayed against internal services.
- Disable NTLM where feasible; the article recommends setting RestrictSendingNTLMTraffic to 2 (Deny all) after auditing for impact.
- Alert on search: and search-ms: URIs in mail-flow and proxy logs.
MITRE ATT&CK
CVE
People
Aaron DealAcknowledged for contributions and edits to the article.Andrew SchwartzAuthor of the article and reporter of the search: URI-handler NTLM leakage behavior to MSRC.Beth RobinsonAcknowledged for contributions and edits to the article.Casey SmithReviewed a draft and prompted testing whether the issue could be triggered by clicking a link.Jon SemonAcknowledged for contributions and edits to the article.Lindsey O'Donnell-WelchAcknowledged for contributions and edits to the article.Tyler BohlmannAcknowledged for contributions and edits to the article.
Vendors
Products
ExplorerFrame.dllxCyclopedia both identify as SearchExecute (also called CLSID_SearchMSExecute), implemented in ExplorerFrame.dll. They aren't sibling handlers that happen to look alike. They're two URI schemes wired to one COMMicrosoft WindowsSame bug class. No CVE. No fix. The NTLM leakage primitive in the Windows search: URI handler is technically identical to CVE-2026-33829 in the Snipping Tool. Same severity rating, same mechanism, same potential impact.Windows Snipping ToolOn April 14, 2026, Microsoft patched CVE-2026-33829, an NTLM credential leakage bug in the Windows Snipping Tool with a CVSS score of 4.3. The issue lived in the Snipping Tool’s ms-screensketch: URI handler, the part of