CVE-2025-24054
NTLM Hash Disclosure Spoofing Vulnerability
- Published
- Mar 11, 2025
- Updated
- Feb 13, 2026
- Assigning CNA
- microsoft
- Evidence observed
- Apr 17, 2025
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NHigh · next 30 days
- Percentile
- 99.2%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
Sources
POC for CVE-2025-24071
Proof of Concept for the NTLM Hash Leak via .library-ms CVE-2025-24054 / CVE-2025-24071
Proof-of-concept exploit for CVE-2025-24054, a Windows Library (.library-ms) NTLM hash disclosure vulnerability. Generates a malicious .library-ms file to leak Net-NTLMv2 hashes via SMB when extracted from a ZIP archive.
Windows File Explorer Zero Click NTLMv2-SSP Hash Disclosure
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.