CVE-2025-50154

Published Aug 12, 2025

Last updated 3 days ago

Microsoft

Windows File Explorer

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-50154 is a vulnerability that bypasses a previous Microsoft security patch (CVE-2025-24054) and allows for the extraction of NTLM hashes without user interaction, even on fully patched systems. This is achieved by exploiting a gap in the original mitigation, enabling automatic NTLM authentication requests. The vulnerability involves manipulating Windows shortcut files (LNK) and how the explorer.exe process handles remote binary retrieval. Specifically, the bypass works because the initial patch didn't fully address how icons are rendered for remote binary files. Even though the patch prevented shortcuts from rendering icons based on UNC paths, it didn't account for remote binaries that store their own icon data. When Windows Explorer attempts to display a specially crafted shortcut, it retrieves the entire remote binary to extract the icon, triggering NTLM authentication in the process, without requiring any user clicks.

Description: Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
Source: secure@microsoft.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Weaknesses

secure@microsoft.com: CWE-200

Hype score: Not currently trending

References