---
title: "Windows NTLM CVE-2025-24054: .library-ms Hash Leak"
url: https://erroneo.us/security/briefs/windows-ntlm-cve-2025-24054-library-ms-hash-leak/
description: "A crafted .library-ms file leaked NTLMv2 hashes with barely a click; exploited 8 days after the March 2025 fix. Confirm patches and block outbound SMB."
type: security-brief
section: "Security Digest"
date_published: 2025-03-11
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-24054"]
severity: "medium"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Windows NTLM CVE-2025-24054: .library-ms Hash Leak

**Verdict: Check exposure.** Patched in March 2025 and exploited within days; the fix is old, but the real exposure is any network that still lets Windows send NTLM to the internet over SMB or accepts relayed NTLM, so confirm both.

- **Who must act:** Admins of Windows hosts below the March 2025 builds, and of networks that allow outbound SMB (TCP 445) to the internet or lack SMB signing and LDAP channel binding on relay targets.
- **Who can relax:** Fleets current since March 2025 that block outbound SMB at the edge and enforce signing are covered for this bug and for most of its many look-alikes.
- **Affected:** Windows 10 1507, 1607, 1809, 21H2, 22H2 before builds 10240.20947 / 14393.7876 / 17763.7009 / 19044.5608 / 19045.5608; Windows 11 22H2 / 23H2 before 22621.5039 / 22631.5039; Windows 11 24H2 before 26100.3476; Windows Server 2016 / 2019 / 2022 before 14393.7876 / 17763.7009 / 20348.3328; Windows Server 2025 before 26100.3476; Windows Server 2008 R2 SP1, 2012, 2012 R2 before the March 2025 updates
- **Fixed:** March 11, 2025 cumulative updates, e.g. KB5053598 (Windows 11 24H2 / Server 2025), KB5053602 (Windows 11 23H2), KB5053606 (Windows 10 22H2); KB5053603 (Server 2022), KB5053596 (Server 2019), KB5053594 (Server 2016), KB5053887 (Server 2012 R2); Any later cumulative update
- **CVEs:** CVE-2025-24054
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Confirm every Windows host runs the March 11, 2025 cumulative update or later.
2. Block outbound SMB (TCP 445 and 139) from your network to the internet at the firewall.
3. Make captured hashes less useful: require SMB signing, LDAP signing and channel binding, and put admins in the Protected Users group.
4. Block or quarantine .library-ms, .url and .website files in mail and web downloads; users have no business receiving them.
5. If a hash may have leaked, reset that user's password, since NTLMv2 responses can be cracked offline.

### How to check if you are affected

- Search firewall and proxy logs for outbound TCP 445 to 159.196.128[.]120 and 194.127.179[.]157, the SMB servers Check Point published.
- Look for .library-ms files in Downloads, Temp and mail attachment folders, and for an archive named xd.zip.
- Match Check Point's SHA-1 hashes for xd.zip, xd.library-ms, xd.url, xd.website and xd.lnk against EDR file telemetry.
- Review any outbound SMB connection to a public IP; Windows should almost never authenticate to an internet SMB server.

## What happened

On March 11, 2025, Microsoft fixed [CVE-2025-24054](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054), an "external control of file name or path" flaw (CWE-73) in Windows NTLM. A crafted file makes Windows reach out to a server the attacker names and hand over the user's NTLMv2 response. Microsoft says "minimal interaction" is enough: selecting the file with a single click, right-clicking it, or any action other than opening it. Microsoft rates it Important, CVSS 3.1 6.5. NVD scores it 5.4. The [March CVRF data](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2025-Mar) credits Rintaro Koike of NTT Security Holdings, 0x6rss, hyp3rlinx and j00sean.

It was not a zero-day, but attackers moved fast. On April 16, 2025, [Check Point Research](https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/) reported exploitation "since March 19, 2025", eight days after the patch. Around March 20 and 21, phishing mails sent targets, mainly Polish and Romanian government and private institutions, a Dropbox link to `xd.zip`. Inside were four hash-leaking files: `xd.library-ms` for this bug, which fired on extraction, plus `.url`, `.website` and `.lnk` files. One pointed at `159.196.128.120`, an IP HarfangLab tied to APT28 in 2024, though Check Point says it has no further link to that group. By March 25 it had seen about 11 campaigns, including bare `.library-ms` attachments sent to companies worldwide and pointing at `194.127.179.157`. Check Point calls the bug a likely variant of CVE-2024-43451, exploited against Ukraine and patched in November 2024. CISA added CVE-2025-24054 to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24054) on April 17, 2025. Microsoft's advisory still lists it as not exploited.

## Who is affected

The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-24054) lists every supported Windows client and server from Windows 10 1507 and Server 2008 R2 to Windows 11 24H2 and Server 2025. Fixed builds include 19045.5608 for Windows 10 22H2, 22631.5039 for Windows 11 23H2, 26100.3476 for Windows 11 24H2 and Server 2025, and 20348.3328 for Server 2022.

## Do you really need to act?

Patch-wise, probably not: any host updated since March 2025 has the fix. But treat this as one entry in a long family. The same attack, a file that makes Windows authenticate to an attacker's SMB server, has come back through WordPad (CVE-2023-36563), `.url` files (CVE-2024-43451) and now library files. Each fix closes one path. The durable defense is network policy. If outbound TCP 445 is blocked at your edge, the leak never leaves. If SMB signing, LDAP signing and channel binding are enforced, a captured response cannot be relayed. Weak passwords can still be cracked offline. Also note that Windows 10 devices without Extended Security Updates have had no fixes since [October 14, 2025](https://support.microsoft.com/en-us/windows/windows-10-support-has-ended-on-october-14-2025-2ca8b313-1946-43d3-b55c-2b95b107f281).

## What to do now

1. Check builds with `Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR` and update anything below the fixed builds.
2. Block outbound SMB at the perimeter. On hosts that roam, add `New-NetFirewallRule -DisplayName "Block SMB to Internet" -Direction Outbound -Protocol TCP -RemotePort 445 -RemoteAddress Internet -Action Block`.
3. Enforce SMB signing and LDAP signing with channel binding, and add privileged accounts to Protected Users.
4. Strip `.library-ms`, `.url`, `.website` and `.lnk` attachments at the mail gateway, including inside archives.

## How to tell if you were hit

- Search firewall logs for outbound TCP 445 to `159.196.128[.]120`, `194.127.179[.]157` or any public IP.
- Run `Get-ChildItem C:\Users\*\Downloads,C:\Users\*\AppData\Local\Temp -Recurse -Include *.library-ms -ErrorAction SilentlyContinue`. Legitimate library files live under `AppData\Roaming\Microsoft\Windows\Libraries`.
- Match Check Point's SHA-1 hashes for `xd.zip` and its four files against EDR telemetry.
- For any user whose hash may have leaked, reset the password and review logons for relay activity.

## Timeline

- Mar 11, 2025 — Microsoft fixes the bug in Patch Tuesday.
- Mar 19, 2025 — Check Point observes the first exploitation.
- Mar 20–21, 2025 — Phishing campaign against Polish and Romanian targets.
- Mar 25, 2025 — Check Point finds a worldwide campaign with bare .library-ms files.
- Apr 16, 2025 — Check Point publishes its research.
- Apr 17, 2025 — CISA adds the CVE to KEV, with a May 8 deadline.

## Sources

1. [Microsoft MSRC — CVE-2025-24054 NTLM Hash Disclosure Spoofing Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054)
2. [Microsoft MSRC — March 2025 Security Updates (CVRF data with KB numbers and acknowledgments)](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2025-Mar)
3. [CVE record — CVE-2025-24054](https://www.cve.org/CVERecord?id=CVE-2025-24054)
4. [NVD — CVE-2025-24054](https://nvd.nist.gov/vuln/detail/CVE-2025-24054)
5. [CISA — Known Exploited Vulnerabilities: CVE-2025-24054](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24054)
6. [Check Point Research — CVE-2025-24054, NTLM Exploit in the Wild](https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/)
7. [Microsoft Support — Windows 10 support has ended on October 14, 2025](https://support.microsoft.com/en-us/windows/windows-10-support-has-ended-on-october-14-2025-2ca8b313-1946-43d3-b55c-2b95b107f281)

---
Source page: https://erroneo.us/security/briefs/windows-ntlm-cve-2025-24054-library-ms-hash-leak/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt