PT-2026-32887 · Microsoft · Snipping Tool+1

Marcos Díaz · Published 2026-04-14 · Updated 2026-06-03 · CVE-2026-33829

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Windows Snipping Tool (affected versions not specified)

Description An issue in the Windows Snipping Tool involves the exposure of sensitive information to unauthorized actors, which allows remote attackers to perform spoofing attacks over a network. Specifically, the application leaks NTLM (NT LAN Manager) authentication responses, which are hashes used for Windows authentication. Exploitation requires user interaction, such as tricking a victim into visiting a malicious webpage or opening a crafted link that invokes the Snipping Tool via the ms-screenclip or ms-screensketch URI schemes. This action causes the tool to connect to an attacker-controlled SMB (Server Message Block) server, leading Windows to silently send the user's NTLMv2 hash, which can then be cracked or relayed to gain unauthorized access to corporate networks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2026-05657

CVE-2026-33829

Affected Products

Snipping Tool

Windows

References · 28

• 🔥 https://github.com/blackarrowsec/redteam-research/tree/master/CVE-2026-33829 · Exploit
• 🔥 https://exploit-db.com/exploits/52567 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33829 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33829 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-33829 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05657 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33829 · Security Note
• https://twitter.com/cirtgovjm/status/2046698474821816701 · Twitter Post
• https://twitter.com/autumn_good_35/status/2046590375280967995 · Twitter Post
• https://twitter.com/Tinolle1955/status/2045211501305159703 · Twitter Post
• https://twitter.com/BlackArrowSec/status/2044374743491424508 · Twitter Post
• https://twitter.com/UndercodeUpdate/status/2045910235185836365 · Twitter Post
• https://twitter.com/Im_AjayPrakash/status/2046721832146096570 · Twitter Post
• https://twitter.com/0dayPublishing/status/2046588508010164411 · Twitter Post
• https://twitter.com/cybrsecpath/status/2046631959456358735 · Twitter Post