0patch has disclosed a significant 0day vulnerability impacting all desktop versions of Windows, including Windows Server. This security flaw, identified as a URL File NTLM Hash Disclosure vulnerability, affects an impressive 21 different editions of the operating system.
In light of this discovery, 0patch has promptly reported the issue to Microsoft. However, as has been the case in previous instances, the tech giant has yet to provide a remedy. In response to the urgent need for protection, 0patch has taken the initiative to release free micropatches for all affected Windows versions.
Details of the Vulnerability
Due to the sensitive nature of the vulnerability, 0patch is withholding specific details for the time being. The micropatches are designed to safeguard users until Microsoft issues its official fixes. Once Microsoft releases its updates, 0patch intends to disclose further information regarding the vulnerability.
According to 0patch, their researchers uncovered a vulnerability that spans all Windows Workstation and Server versions, from Windows 7 and Server 2008 R2 to the latest Windows 11 v24H2 and Server 2022. This vulnerability enables an attacker to extract a user’s NTLM credentials merely by having the user open a malicious file in Windows Explorer. This could occur through various means, such as accessing a shared folder, connecting a USB drive containing the file, or viewing the Downloads folder where the file was automatically downloaded from a malicious website.
To obtain the free micropatch, users must create a complimentary account in 0patch Central. Below is the comprehensive list of affected Windows editions:
Legacy Windows Versions:
- Windows 11 v21H2 – fully updated
- Windows 10 v21H2 – fully updated
- Windows 10 v21H1 – fully updated
- Windows 10 v20H2 – fully updated
- Windows 10 v2004 – fully updated
- Windows 10 v1909 – fully updated
- Windows 10 v1809 – fully updated
- Windows 10 v1803 – fully updated
- Windows 7 – fully updated with no ESU, ESU 1, ESU 2 or ESU 3
- Windows Server 2012 – fully updated with no ESU or ESU 1
- Windows Server 2012 R2 – fully updated with no ESU or ESU 1
- Windows Server 2008 R2 – fully updated with no ESU, ESU 1, ESU 2, ESU 3 or ESU 4
Windows Versions Still Receiving Updates:
- Windows 11 v24H2 – fully updated
- Windows 11 v23H2 – fully updated
- Windows 11 v22H2 – fully updated
- Windows 10 v22H2 – fully updated
- Windows Server 2022 – fully updated
- Windows Server 2019 – fully updated
- Windows Server 2016 – fully updated
- Windows Server 2012 fully updated with ESU 2
- Windows Server 2012 R2 fully updated with ESU 2
For those seeking additional information, further details can be found on 0patch’s official channels.
