Loading vulnerability…
Windows NTLM Hash Disclosure Spoofing Vulnerability
CVE-2025-21377 is an NTLM credential disclosure vulnerability in Windows involving external control of a file name or path. A specially crafted Internet shortcut file can expose a user's NTLMv2 authentication material when Windows Explorer displays or processes the file. Opening or executing the file is not required; viewing its containing folder, selecting it, or inspecting it can trigger disclosure. Affected platforms include Windows workstation and server releases from Windows 7 and Windows Server 2008 R2 through Windows 11 version 24H2 and Windows Server 2022. Microsoft addressed the vulnerability in its February 2025 security updates.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote, unauthenticated attacker can obtain a Windows user's NTLMv2 authentication material through minimal user interaction with an attacker-supplied file. This compromises authentication confidentiality and can facilitate spoofing or subsequent credential attacks. The vulnerability does not itself establish arbitrary code execution or privilege escalation.
If you can’t patch tonight, do this now.
0patch supplied micropatches for affected Windows releases before Microsoft's official fix, with application possible without rebooting. Where official updates cannot immediately be deployed, verify that an applicable micropatch is available and enabled for the exact operating-system build. Reducing exposure to untrusted Internet shortcut files can reduce risk, but avoiding file execution alone is insufficient because Explorer interaction can trigger disclosure.
Patch, then assume compromise.
Install the applicable Microsoft February 2025 Windows security update addressing CVE-2025-21377, or a later cumulative update that includes the fix. Ensure both Windows workstations and affected Windows Server installations are covered.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.