Potential CVE-2026-33829 Exploitation - Windows Snipping Tool Remote File Path URI

Samir Bousseaden, Swachchhanda Shrawan Poudel (Nextron Systems)

Detects potential exploitation of CVE-2026-33829, a vulnerability in the Windows Snipping Tool URI handler (ms-screensketch:). An attacker can abuse the 'filePath' parameter to supply a UNC path or HTTP URL, causing SnippingTool.exe to initiate a connection to a remote resource. When a UNC path is used (e.g. \\attacker.com\share), this triggers an outbound NTLM authentication attempt, allowing the attacker to capture or relay the victim's Net-NTLMv2 hash. HTTP-based paths may result in remote file loading or server-side request forgery (SSRF)-style access. The URI can be delivered via a malicious hyperlink, phishing email, or web page.

2026-04-28 00:00:00

None

7c3a5b1d-9e2f-4a8c-b5d7-1e0f3c6a9b2d

attack.credential-access attack.t1187 detection.emerging-threats cve.2026-33829

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #5942 from @swachchhanda000 - Add `Potential CVE-2026-33829 Exploitation - Windows Snipping Tool Remote File Path URI`

2026-04-28