Loading vulnerability…
CVE-2025-50154 is a Windows File Explorer information disclosure and spoofing-related vulnerability that bypasses Microsoft's earlier fix for CVE-2025-24054. The issue arises from the way File Explorer processes specially crafted shortcut content that causes Explorer to access a remote UNC-hosted executable in order to extract embedded icon resources. Because the icon is obtained from resources embedded in the remote binary rather than from a directly referenced remote icon file, the prior patch logic can be bypassed. During this automatic retrieval, Windows initiates NTLM authentication to the remote server without user interaction, exposing NTLM credential material over the network. The behavior has been described as zero-click because rendering by Explorer is sufficient to trigger the outbound authentication on fully patched systems affected by the incomplete prior fix.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
This repository provides a Cobalt Strike Aggressor script (lnk_weaponizer.cna) and a standalone PowerShell script (standalone_lnk_weaponizer.ps1) for generating weaponized Windows LNK and Library-MS files. The primary purpose is to capture NTLMv2-SSP hashes from Windows systems by tricking users into opening these files, which point to attacker-controlled SMB shares. The Aggressor script integrates with Cobalt Strike, offering both GUI and command-line interfaces for file generation, including a right-click menu for beacons. The Library-MS technique implements a bypass for CVE-2025-24054, allowing for additional evasion of security controls. The PowerShell script supports both single-target and batch operations via CSV. The repository includes documentation (README.md, INSTALL.md), usage scenarios, and sample target files. The exploit is operational, providing real-world red team capabilities for credential capture and lateral movement in Windows environments.
This repository provides a proof-of-concept exploit for CVE-2025-50154, a Windows File Explorer zero-click NTLMv2-SSP hash disclosure vulnerability. The exploit consists of a PowerShell script (poc.ps1) that generates a malicious .LNK shortcut file. The shortcut's target path points to a remote SMB share hosting a binary file, while the icon is set to the default Windows shell32.dll. When a victim's Windows Explorer renders the shortcut, it attempts to fetch the icon from the remote file, causing the victim's NTLMv2-SSP hash to be sent to the attacker's SMB server. The repository includes a README with detailed usage instructions and a LICENSE file. The main exploit capability is to trigger NTLM hash disclosure over the network without user interaction, leveraging Windows Explorer's icon rendering behavior.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
39 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A zero-click NTLM credential (NTLMv2 hash) leakage issue in Windows Explorer shortcut/icon handling that bypasses Microsoft’s prior fix for CVE-2025-24054. By crafting an LNK that points TargetPath to a remote UNC-hosted binary while using a local icon location, Explorer fetches the remote file to extract embedded icon resources, triggering automatic NTLM authentication to the attacker-controlled SMB server and leaking NTLM hashes; it can also stage a remote binary on disk without user interaction.
Referenced as an earlier vulnerability that CVE-2025-59214 bypasses; part of a chain of bypasses related to NTLM credential leakage protections.
A bypass of Microsoft’s prior fix for an NTLM credential leakage issue, indicating the earlier patch left a gap that still allowed NTLM hash leakage under certain conditions.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.