BreachPublished 24 Oct 2025

Microsoft Disables Downloaded File Previews to Block NTLM Hash Leaks

Source SecurityWeek

Description

In files downloaded from the internet, HTML tags referencing external paths could be used to leak NTLM hashes during file previews. The post Microsoft Disables Downloaded File Previews to Block NTLM Hash Leaks appeared first on SecurityWeek .

Impact

The primary impact of this vulnerability is the potential leakage of NTLM authentication hashes, which can compromise the confidentiality of user credentials. Once attackers obtain these hashes, they can perform relay or pass-the-hash attacks to gain unauthorized access to network resources, leading to lateral movement and potential privilege escalation. For European organizations, this could result in data breaches, disruption of services, and exposure of sensitive information, especially in sectors such as finance, healthcare, and critical infrastructure. The attack requires user interaction (previewing a downloaded file), which somewhat limits the scope but does not eliminate the risk, particularly in environments where users frequently handle files from external sources. The disabling of file previews reduces the attack surface but may impact user productivity. The absence of known exploits in the wild suggests limited immediate risk, but the vulnerability remains a credible threat vector for targeted attacks. Organizations with extensive Windows deployments and reliance on NTLM authentication are most at risk. The impact on integrity and availability is indirect but possible if attackers leverage stolen credentials to deploy malware or disrupt operations.

Defensive guidance

To mitigate this threat, organizations should implement the following specific measures: 1) Ensure that the latest Microsoft updates or patches that disable file previews for downloaded files are applied promptly. 2) Configure Windows Group Policy settings to disable file preview features for files originating from the internet zone. 3) Implement network segmentation and firewall rules to restrict outbound NTLM authentication traffic, especially to untrusted external networks. 4) Deploy endpoint detection and response (EDR) solutions to monitor for suspicious NTLM authentication attempts and lateral movement indicators. 5) Educate users about the risks of previewing files from untrusted sources and reinforce phishing awareness training. 6) Consider migrating from NTLM to more secure authentication protocols such as Kerberos where feasible. 7) Regularly audit and monitor authentication logs for unusual patterns that may indicate hash relay or pass-the-hash attacks. 8) Employ application whitelisting and sandboxing to limit execution of potentially malicious downloaded files. These measures go beyond generic advice by focusing on configuration changes, network controls, and user behavior to reduce the attack surface and detect exploitation attempts.

References

securityweek.com/microsoft-disables-downloaded-file-previews-to-block-ntlm-hash-leaks/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 24 Oct 2025, 10:04 UTC

References

Community reviews