Researchers at ACROS Security disclosed a zero-day authentication coercion flaw in Windows Themes that bypasses Microsoft’s prior fixes for CVE-2024-21320 and CVE-2024-38030. The vulnerability resides in theme parsing logic within themeui.dll during thumbnail rendering. While Microsoft implemented validation routines like IsUNCPathAllowedForThumbnailImage to restrict remote Universal Naming Convention (UNC) paths, an incomplete fix leaves adjacent resource parameters, including BrandImage, unsanitized. When a malicious .theme file is viewed in Windows Explorer or placed on a desktop, the shell automatically initiates outbound SMB or WebDAV connection requests to attacker-controlled infrastructure.

This forced network connection leaks the user’s NetNTLMv2 challenge-response hashes without requiring file execution, clicks, or confirmation beyond directory browsing. Adversaries can capture these hashes for offline cracking or real-time NTLM relay attacks against internal Active Directory resources. The zero-day impacts all Windows versions, including Windows 11 24H2 and Windows Server. In the absence of an official vendor update, ACROS Security released free 0patch micropatches to hook vulnerable library routines and neutralize remote UNC path resolution.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Passive thumbnail parsing in the Windows shell triggers outbound NTLM handshakes, collapsing workstation boundaries and exposing cryptographic hashes to relay attacks without executing untrusted binaries or tripping EDR alerts.
• Bullet 2 — Strategic & Defender Imperative: Defenders should block outbound SMB (TCP port 445) at firewalls, enforce SMB signing and Extended Protection for Authentication (EPA), deploy 0patch mitigations, and accelerate Active Directory migration away from NTLM.