PT-2025-32777 · Microsoft · Windows File Explorer+1

Ruben Enkaoua · Published 2025-08-12 · Updated 2026-02-12 · CVE-2025-50154

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions (affected versions not specified)

Description This issue involves a security flaw in Windows File Explorer that allows an attacker to extract NTLM hashes without user interaction, even on systems with the latest security patches applied. The vulnerability stems from insufficient protection of service data when processing NTLM hashes. An attacker can exploit this by creating a specially crafted LNK file, triggering NTLM authentication requests automatically. This enables potential offline cracking or relay attacks to gain unauthorized access. The vulnerability allows for spoofing over a network and impacts the system's security. The issue is a patch bypass, meaning existing mitigations are circumvented.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2025-09832

CVE-2025-50154

ZDI-25-964

Affected Products

Windows

Windows File Explorer

References · 57

• 🔥 https://vicarius.io/vsociety/posts/cve-2025-50154-detection-script-zero-click-windows-file-explorer-spoofing-vulnerability · Exploit
• 🔥 https://vicarius.io/vsociety/posts/cve-2025-50154-mitigation-script-zero-click-windows-file-explorer-spoofing-vulnerability · Exploit
• 🔥 https://exploit-db.com/exploits/52415 · Exploit
• 🔥 https://github.com/rubenformation/CVE-2025-50154 · Exploit
• https://zerodayinitiative.com/advisories/ZDI-25-964 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-50154 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-50154 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-50154 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/723757 · Security Note
• https://bdu.fstec.ru/vul/2025-09832 · Security Note
• https://osv.dev/vulnerability/CVE-2025-50154 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50154 · Security Note
• https://twitter.com/0x534c/status/1955703371039695037 · Twitter Post
• https://t.me/RNetsec/21872 · Telegram Post
• https://t.me/OffensiveTwitter/3023 · Telegram Post