screen savers

All versions of Windows clients, from Windows 7 to Windows 11, are exposed to a critical 0-day vulnerability that allows attackers to capture NTLM authentication hashes. This vulnerability was reported by ACROS Security after their investigation into CVE-2024-38030, which involved Windows Themes spoofing. The flaw facilitates an authentication coercion attack, where a vulnerable device sends NTLM hashes to an attacker’s system. The issue arises from how Windows processes theme files, particularly due to inadequate validation of file paths. This is the third vulnerability linked to the same file path problem. Microsoft is aware of the report and will take necessary actions, but no CVE has been issued yet. Attackers do not need special privileges but must convince users to interact with a malicious theme file. Disabling NTLM is advised, although it may cause functional issues in dependent network components.