CVE-2025-24054

Microsoft · Published March 11, 2025

6.5

CVSS v3.1

MEDIUM

CISA KEV — Federal agencies must patch by deadline

Actively exploited in the wild

Patch availableGet patch

Description

Windows NTLM hash disclosure via specially crafted .library-ms files. When a user navigates to a folder containing the malicious file in Explorer, their NTLMv2 hash is leaked to an attacker-controlled server without any clicks.

Affected Products

Windows 10/11 (all versions)
Windows Server 2016/2019/2022/2025

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Related Advisories

CVEMEDIUMCVE-2025-24054

Windows NTLM Hash Disclosure (CVE-2025-24054) Actively Exploited in Phishing Campaigns

A zero-click NTLM hash leak via .library-ms files is being actively exploited in phishing campaigns targeting government and private sector organizations in Poland and Romania.

WHY IT MATTERS

A user opening a folder in Windows Explorer can leak their NTLMv2 hash with zero clicks — enable SMB signing everywhere and apply the March patch.

MicrosoftWindowsNTLM Relay+2 more

Apr 1, 2025· 5 min read