NTLM Hash Disclosure in Windows Snipping Tool ms-screensketch URI Handler

CVE-2026-33829 is a moderate-severity spoofing/information disclosure vulnerability in Microsoft Windows Snipping Tool. The flaw is in the application's handling of deep links registered under the ms-screensketch URI scheme, specifically acceptance of a filePath parameter without sufficient validation. By supplying a crafted ms-screensketch link whose filePath points to an attacker-controlled UNC path, an attacker can cause Snipping Tool to initiate an outbound SMB connection to a remote server. During that connection, Windows may automatically perform NTLM authentication in the security context of the current user, exposing the user's Net-NTLMv2 response to the attacker. Public reporting describes exploitation via malicious webpages, phishing emails, or other crafted URL sources that launch Snipping Tool and make the activity appear legitimate while the credential material is leaked in the background.