erroneo.us
Search all guides⌘K

Security Digest · Mar 11, 2025 · Vulnerability · OS / kernel

Windows NTLM CVE-2025-24054: .library-ms Hash Leak

A crafted .library-ms file leaked NTLMv2 hashes with barely a click; exploited 8 days after the March 2025 fix. Confirm patches and block outbound SMB.

Published By erroneo.us Security Desk · Updated 3 min read7 sources

Our verdict

Check exposure

Patched in March 2025 and exploited within days; the fix is old, but the real exposure is any network that still lets Windows send NTLM to the internet over SMB or accepts relayed NTLM, so confirm both.

Who must act: Admins of Windows hosts below the March 2025 builds, and of networks that allow outbound SMB (TCP 445) to the internet or lack SMB signing and LDAP channel binding on relay targets.

Who can relax: Fleets current since March 2025 that block outbound SMB at the edge and enforce signing are covered for this bug and for most of its many look-alikes.

Affected
Windows 10 1507, 1607, 1809, 21H2, 22H2 before builds 10240.20947 / 14393.7876 / 17763.7009 / 19044.5608 / 19045.5608
Windows 11 22H2 / 23H2 before 22621.5039 / 22631.5039; Windows 11 24H2 before 26100.3476
Windows Server 2016 / 2019 / 2022 before 14393.7876 / 17763.7009 / 20348.3328
Windows Server 2025 before 26100.3476
Windows Server 2008 R2 SP1, 2012, 2012 R2 before the March 2025 updates
Fixed in
March 11, 2025 cumulative updates, e.g. KB5053598 (Windows 11 24H2 / Server 2025), KB5053602 (Windows 11 23H2), KB5053606 (Windows 10 22H2)
KB5053603 (Server 2022), KB5053596 (Server 2019), KB5053594 (Server 2016), KB5053887 (Server 2012 R2)
Any later cumulative update
CVSS
6.5 (v3.1, vendor)
EPSS
62.3% (percentile 99)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Medium

What to do

  1. Confirm every Windows host runs the March 11, 2025 cumulative update or later.
  2. Block outbound SMB (TCP 445 and 139) from your network to the internet at the firewall.
  3. Make captured hashes less useful: require SMB signing, LDAP signing and channel binding, and put admins in the Protected Users group.
  4. Block or quarantine .library-ms, .url and .website files in mail and web downloads; users have no business receiving them.
  5. If a hash may have leaked, reset that user's password, since NTLMv2 responses can be cracked offline.

How to check if you are affected or compromised

  • Search firewall and proxy logs for outbound TCP 445 to 159.196.128[.]120 and 194.127.179[.]157, the SMB servers Check Point published.
  • Look for .library-ms files in Downloads, Temp and mail attachment folders, and for an archive named xd.zip.
  • Match Check Point's SHA-1 hashes for xd.zip, xd.library-ms, xd.url, xd.website and xd.lnk against EDR file telemetry.
  • Review any outbound SMB connection to a public IP; Windows should almost never authenticate to an internet SMB server.

What happened#

On March 11, 2025, Microsoft fixed CVE-2025-24054, an "external control of file name or path" flaw (CWE-73) in Windows NTLM. A crafted file makes Windows reach out to a server the attacker names and hand over the user's NTLMv2 response. Microsoft says "minimal interaction" is enough: selecting the file with a single click, right-clicking it, or any action other than opening it. Microsoft rates it Important, CVSS 3.1 6.5. NVD scores it 5.4. The March CVRF data credits Rintaro Koike of NTT Security Holdings, 0x6rss, hyp3rlinx and j00sean.

It was not a zero-day, but attackers moved fast. On April 16, 2025, Check Point Research reported exploitation "since March 19, 2025", eight days after the patch. Around March 20 and 21, phishing mails sent targets, mainly Polish and Romanian government and private institutions, a Dropbox link to xd.zip. Inside were four hash-leaking files: xd.library-ms for this bug, which fired on extraction, plus .url, .website and .lnk files. One pointed at 159.196.128.120, an IP HarfangLab tied to APT28 in 2024, though Check Point says it has no further link to that group. By March 25 it had seen about 11 campaigns, including bare .library-ms attachments sent to companies worldwide and pointing at 194.127.179.157. Check Point calls the bug a likely variant of CVE-2024-43451, exploited against Ukraine and patched in November 2024. CISA added CVE-2025-24054 to the KEV catalog on April 17, 2025. Microsoft's advisory still lists it as not exploited.

Who is affected#

The CVE record lists every supported Windows client and server from Windows 10 1507 and Server 2008 R2 to Windows 11 24H2 and Server 2025. Fixed builds include 19045.5608 for Windows 10 22H2, 22631.5039 for Windows 11 23H2, 26100.3476 for Windows 11 24H2 and Server 2025, and 20348.3328 for Server 2022.

Do you really need to act?#

Patch-wise, probably not: any host updated since March 2025 has the fix. But treat this as one entry in a long family. The same attack, a file that makes Windows authenticate to an attacker's SMB server, has come back through WordPad (CVE-2023-36563), .url files (CVE-2024-43451) and now library files. Each fix closes one path. The durable defense is network policy. If outbound TCP 445 is blocked at your edge, the leak never leaves. If SMB signing, LDAP signing and channel binding are enforced, a captured response cannot be relayed. Weak passwords can still be cracked offline. Also note that Windows 10 devices without Extended Security Updates have had no fixes since October 14, 2025.

What to do now#

  1. Check builds with Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR and update anything below the fixed builds.
  2. Block outbound SMB at the perimeter. On hosts that roam, add New-NetFirewallRule -DisplayName "Block SMB to Internet" -Direction Outbound -Protocol TCP -RemotePort 445 -RemoteAddress Internet -Action Block.
  3. Enforce SMB signing and LDAP signing with channel binding, and add privileged accounts to Protected Users.
  4. Strip .library-ms, .url, .website and .lnk attachments at the mail gateway, including inside archives.

How to tell if you were hit#

  • Search firewall logs for outbound TCP 445 to 159.196.128[.]120, 194.127.179[.]157 or any public IP.
  • Run Get-ChildItem C:\Users\*\Downloads,C:\Users\*\AppData\Local\Temp -Recurse -Include *.library-ms -ErrorAction SilentlyContinue. Legitimate library files live under AppData\Roaming\Microsoft\Windows\Libraries.
  • Match Check Point's SHA-1 hashes for xd.zip and its four files against EDR telemetry.
  • For any user whose hash may have leaked, reset the password and review logons for relay activity.

Timeline#

  • — Microsoft fixes the bug in Patch Tuesday.
  • — Check Point observes the first exploitation.
  • — Phishing campaign against Polish and Romanian targets.
  • — Check Point finds a worldwide campaign with bare .library-ms files.
  • — Check Point publishes its research.
  • — CISA adds the CVE to KEV, with a May 8 deadline.

Vulnerability records

  • CVE-2025-24054 · KEV 2025-04-17 · External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Microsoft MSRC — CVE-2025-24054 NTLM Hash Disclosure Spoofing Vulnerability msrc.microsoft.com
  2. Microsoft MSRC — March 2025 Security Updates (CVRF data with KB numbers and acknowledgments) api.msrc.microsoft.com
  3. CVE record — CVE-2025-24054 cve.org
  4. NVD — CVE-2025-24054 nvd.nist.gov
  5. CISA — Known Exploited Vulnerabilities: CVE-2025-24054 cisa.gov
  6. Check Point Research — CVE-2025-24054, NTLM Exploit in the Wild research.checkpoint.com
  7. Microsoft Support — Windows 10 support has ended on October 14, 2025 support.microsoft.com