CVE-2025-24071

Name of the Vulnerable Software and Affected Versions Windows File Explorer (affected versions not specified)

Description An information disclosure and spoofing issue exists in Windows File Explorer that allows an unauthorized network attacker to obtain sensitive information. Specifically, the flaw enables the theft of NTLM hashed passwords. Exploitation can occur when a user is convinced to extract a malicious archive containing a .library-ms file; upon extraction, Windows Explorer automatically initiates an SMB authentication request to an attacker-controlled server, leaking the user's NTLM hash. This process can happen without direct user interaction with the file itself. NTLM (New Technology Local Security Authority) hashes are used by Windows for authentication and can be cracked to recover plain-text passwords or used in Pass-the-Hash attacks to impersonate users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.