Windows NTLM spoofing via file path control leaks credential hashes

External control of file name or path in Windows NTLM (CWE-73) enables spoofing and credential-hash disclosure over a network. A victim browsing to a folder containing a crafted .library-ms or shortcut file triggers an automatic NTLM authentication attempt — no click required, no obvious user interaction. The resulting NTLMv2 hash can be captured with a relay or relay-to-crack pipeline.

Context

The CVSS 6.5 score reflects that an attacker still needs a path to deliver the crafted file — but that’s a lower bar than it sounds. Network shares, WebDAV, phishing lures pointing to a UNC path, and even embedded shortcuts in archive files all work. Rapid7 observed a threat actor QA’ing this CVE alongside CVE-2025-33053 and CVE-2026-21513 in a delivery lab aimed at Mexican targets. The operator was testing search-ms: URI delivery and double-extension spoofing, both realistic file-delivery vectors.

NTLM hash captures feed directly into pass-the-hash, relay, and offline cracking pipelines. Medium CVSS score, but frequently the opening step in a longer chain.

What to do

1. Apply the March 2025 Patch Tuesday update. The fix is shipping since March 11, 2025.
2. Enforce Extended Protection for Authentication (EPA) on all services accepting NTLM. Relay attacks against unprotected endpoints are the most common next step.
3. Consider blocking NTLM outbound at the perimeter. If you can enforce Kerberos in your environment, NTLM-based hash captures lose their value.
4. Block search-ms: URI handler abuse. Registry or GPO can disable the search-ms: protocol handler — it has limited legitimate use and broad phishing history.

Sources

• NVD CVE-2025-24054
• Rapid7 threat research: exposed WebDAV malware lab (via our coverage)