A vulnerability tracked as CVE-2026-33829 allows attackers to force Windows Snipping Tool into sending a user’s NTLMv2 hash to a remote server. The attack works through a crafted ms-screensketch:edit URI — when a victim clicks a malicious link and approves the prompt, Windows automatically authenticates to the attacker’s SMB server.
That hash is valuable. Once captured, it can be used for pass-the-hash attacks or cracked offline with tools like Hashcat.
The exploit goes beyond the original proof of concept. Researchers showed that WPAD poisoning, LLMNR, and mDNS poisoning can all be layered on top — capturing multiple valid hashes from a single click. One interaction, several credentials compromised.
Affected systems include Windows 10, Windows 11, and Windows Server 2012 through 2025 — specifically, any version that hasn’t applied the April 14, 2026 patch. The CVSS score sits at 4.3 (Medium), but the practical impact is higher in environments where NTLM is widely used.
The fix is straightforward: apply the Microsoft patch from April 2026. If you can’t patch immediately, blocking outbound SMB traffic on port 445 and restricting NTLMv2 via Group Policy will reduce exposure. Training users to reject unexpected “Open Snipping Tool” prompts is a useful layer, but relying on user awareness alone isn’t a strategy.
