Microsoft Disables Downloaded File Previews to Block NTLM Hash Leaks

Microsoft has announced that the preview feature in Windows File Explorer for files downloaded from the internet is now disabled as an additional protection against NTLM hash leaks, a change rolled out with the October 2025 Patch Tuesday security updates. The measure applies to all files marked with Mark of the Web and is intended to prevent NTLM hash leakage when a file is previewed, since attackers could exploit the preview feature to capture credentials.

According to Microsoft, the change is designed to block a vulnerability chain involving CVE-2025-50154, CVE-2025-24054 and, possibly, CVE-2025-59214, with the latter described as a File Explorer spoofing issue exploited in the wild. The original bug could be triggered by malicious .library-ms files in ZIP archives, which would cause SMB authentication requests during extraction, leaking NTLM hashes; patches previously deployed for these issues were reported to be bypassable by Cymulate.

To remove the block, users can right-click the downloaded file, select Properties, and then Unblock, though the change may not take effect until the next login. According to Microsoft, the Preview pane for Internet Zone file shares will also warn users about potential harm.