In recent months, 0patch has reported three other zero-day vulnerabilities that Microsoft patched or has yet to address, including a Windows Theme bug (patched as CVE-2025-21308), a Mark of the Web bypass on Server 2012 (still a zero-day without an official patch), and an URL File NTLM Hash Disclosure Vulnerability (patched as CVE-2025-21377). ACROS Security researchers discovered the new SCF File NTLM hash disclosure vulnerability while developing patches for another NTLM hash disclosure issue. This new zero-day hasn't been assigned a CVE-ID and affects all versions of Windows, from Windows 7 up to the latest Windows 11 releases and from Server 2008 R2 to Server 2025. "The vulnerability allows an attacker to obtain user's NTLM credentials by having the user view a malicious file in Windows Explorer - e.g., by opening a shared folder or USB disk with such file, or viewing the Downloads folder where such file was previously automatically downloaded from attacker's web page," said ACROS Security CEO Mitja Kolsek on Tuesday. Free unofficial patches are available for a new Windows zero-day vulnerability that can let remote attackers steal NTLM credentials by tricking targets into viewing malicious files in Windows Explorer. ACROS Security now provides free and unofficial security patches for this zero-day flaw through its 0Patch micropatching service for all affected Windows versions until Microsoft releases official fixes.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 25 Mar 2025 18:25:26 +0000