The Microsoft Office URI Handler NTLM Response Information Disclosure vulnerability (ZDI-26-293) allows remote attackers to obtain NTLM authentication responses by exploiting improper input validation in Office URI scheme handling. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious webpage. The vulnerability was reported to Microsoft in February 2026, but Microsoft declined to issue a security update, stating it did not meet their servicing criteria. The advisory was publicly released by the Zero Day Initiative in April 2026. No patch or official fix is available, and the vulnerability has a CVSS score of 4.3 (low severity).

Successful exploitation results in disclosure of NTLM authentication responses for the current user, potentially allowing an attacker to leverage these credentials in further attacks. However, the vulnerability does not allow code execution or system compromise directly. User interaction is required, limiting the attack vector. The vendor has not issued a patch, indicating the impact is considered low severity by Microsoft.

No official patch or fix is available as Microsoft has declined to service this vulnerability. The primary mitigation is to restrict user interaction with untrusted or potentially malicious Microsoft Office files and links that could trigger the URI handler. Users and administrators should exercise caution when opening Office documents from untrusted sources. Monitor vendor advisories for any future updates.