Microsoft Disables File Preview to Stop NTLM Hash Leaks: A Security Win or Inconvenience?
Microsoft disables the preview feature in Windows File Explorer for internet-downloaded files to prevent NTLM hash leaks. This update, part of the October 2025 Patch Tuesday, aims to protect users from attackers attempting to capture sensitive credentials. Because who knew that previewing files could be such a risky business adventure?
Hot Take:
Looks like Microsoft is throwing a digital wet blanket over our curiosity by disabling the preview feature in File Explorer, effectively saying, “If you want to peek, you better be sure you trust the source!” With these new measures, peeking at internet-downloaded files is now as risky as eating a suspicious-looking burrito from the back of your fridge. Proceed with caution, folks!
Key Points:
– Microsoft disables the File Explorer preview feature for internet-downloaded files to prevent NTLM hash leaks.
– This change addresses vulnerabilities related to NTLM credential leakage, including CVE-2025-59214.
– The update targets files marked with the Mark of the Web (MotW) to increase security.
– Users are warned to verify file origins before unblocking and opening them.
– This security measure is part of the October 2025 Patch Tuesday updates.