Microsoft WordPad NTLM Hash Disclosure Vulnerability

Successful exploitation discloses NTLM hashes from the affected user context. This creates a confidentiality impact by exposing credential material that can enable password cracking, credential relay, follow-on authentication attacks, and potential lateral movement depending on the environment and the privileges associated with the leaked credentials. No direct integrity or availability impact is indicated by the available information.

Until patches are fully deployed, reduce exposure by preventing users from opening untrusted or unsolicited files and by filtering suspicious file deliveries through email and web security controls. Because exploitation requires user interaction, user awareness measures and attachment-handling restrictions materially reduce risk. Where operationally feasible, harden or restrict outbound NTLM authentication to reduce the value of hash disclosure and monitor for anomalous NTLM authentication activity that may indicate exploitation or follow-on abuse.

Apply Microsoft’s October 2023 security updates that address CVE-2023-36563 on all supported affected Windows systems. Prioritize patching endpoints where WordPad is present and where users routinely open externally sourced documents or files. Standard patch validation and enterprise deployment procedures should be followed to ensure the vulnerable WordPad component is updated across the fleet.