Unpatched NTLM Leakage in Windows Search URI Handler

Windows Search URI handlers are vulnerable to an unpatched NTLM leakage primitive that allows remote attackers to capture Net-NTLMv2 hashes via a single link click.

CVE-2026-33829

Executive Summary

A critical NTLM credential leakage vulnerability exists within the Windows 'search:' and 'search-ms:' URI handlers. This flaw is technically identical to the recently patched CVE-2026-33829 in the Snipping Tool but remains unpatched in the Windows Explorer shell. An attacker can exploit this by inducing a user to click a specially crafted link, which forces the victim's computer to authenticate against a remote, attacker-controlled SMB server, leaking the user's Net-NTLMv2 hash.

Technical analysis reveals that both 'search:' and 'search-ms:' URI schemes are wired to the same COM activation path ({90b9bce2-b6db-4fd3-8451-35917ea1081b}) within 'ExplorerFrame.dll'. The vulnerability leverages the 'crumb=location:' parameter to coerce a connection to a UNC path. Despite a Moderate severity rating, the bug provides a potent mechanism for credential theft without requiring the victim to download malware or execute suspicious files.

This vulnerability matters because it represents a significant blind spot for organizations relying solely on CVE-based patching. Microsoft has closed the report without a fix, describing their servicing decisions as 'case-by-case'. Organizations must implement proactive network-level mitigations to neutralize this entire class of NTLM coercion attacks.