0patch uncovers a security vulnerability in all versions of Windows -- and releases free fixes

0patch has revealed a 0day vulnerability that affects all desktop versions of Windows as well as Windows Server. In all, a staggering 21 different editions of Windows have the security issue which is described as a URL File NTLM Hash Disclosure vulnerability.

The security patching firm has reported the issue to Microsoft but -- as has been the case in the past -- the Windows-maker has yet to produce a fix. Stepping up to fill the void, 0patch has released free micropatches for all affected versions of Windows.

See also:

• Dodgy Windows 11 update? Microsoft suggests you use the ‘Fix problems using Windows Update’ option
• Microsoft faces massive class action payouts in cloud computing pricing case
• Microsoft refuses to ease Windows 11’s strict hardware requirements, despite the ditching of Windows 10

For obvious reasons, 0patch is not currently sharing detailed information about the security issue. The free micropatches have been made available to ensure that everyone is kept safe until Microsoft gets around to releasing its own official fixes, and when this happens, 0patch will reveal more details.

In the meantime, 0patch says:

Our researchers discovered a vulnerability on all Windows Workstation and Server versions from Windows 7 and Server 2008 R2 to the latest Windows 11 v24H2 and Server 2022. The vulnerability allows an attacker to obtain user's NTLM credentials by simply having the user view a malicious file in Windows Explorer - e.g., by opening a shared folder or USB disk with such file, or viewing the Downloads folder where such file was previously automatically downloaded from attacker's web page.

To obtain the free patch, you need to create a free account in 0patch Central. The full list of affected editions of the Windows are as follows:

 Legacy Windows versions:

1. Windows 11 v21H2 - fully updated
2. Windows 10 v21H2 - fully updated
3. Windows 10 v21H1 - fully updated
4. Windows 10 v20H2 - fully updated
5. Windows 10 v2004 - fully updated
6. Windows 10 v1909 - fully updated
7. Windows 10 v1809 - fully updated
8. Windows 10 v1803 - fully updated
9. Windows 7 - fully updated with no ESU, ESU 1, ESU 2 or ESU 3
10. Windows Server 2012 - fully updated with no ESU or ESU 1
11. Windows Server 2012 R2 - fully updated with no ESU or ESU 1
12. Windows Server 2008 R2 - fully updated with no ESU, ESU 1, ESU 2, ESU 3 or ESU 4

 Windows versions still receiving Windows Updates:

1. Windows 11 v24H2 - fully updated   
2. Windows 11 v23H2 - fully updated
3. Windows 11 v22H2 - fully updated
4. Windows 10 v22H2 - fully updated
5. Windows Server 2022 - fully updated
6. Windows Server 2019 - fully updated 
7. Windows Server 2016 - fully updated 
8. Windows Server 2012 fully updated with ESU 2
9. Windows Server 2012 R2 fully updated with ESU 2

More information is available here.