一、漏洞详情
Windows Snipping Tool是微软官方内置的轻量级截图编辑工具，广泛预装于Windows 10、Windows 11等桌面系统
近日，监测到官方修复Windows 截图工具NTLM信息泄露漏洞（CVE-2026-33829），该漏洞源于工具对 ms-screensketch协议的filePath参数缺乏严格输入校验，攻击者可构造恶意 SMB 远程路径，诱使工具发起跨网络身份认证。攻击者通过构造恶意链接，触发工具自动连接受控 SMB 服务器，窃取当前用户的Net-NTLM哈希，导致用户身份凭据泄露。随后可利用泄露的哈希进行身份认证、横向移动或进一步网络渗透攻击。
建议受影响用户做好资产自查以及预防工作，以免遭受黑客攻击。
二、影响范围
Windows Server 2012 R2 (Server Core installation) < 6.3.9600.23132
Windows Server 2012 R2 < 6.3.9600.23132
Windows Server 2012 (Server Core installation) < 6.2.9200.26026
Windows Server 2012 < 6.2.9200.26026
Windows Server 2016 (Server Core installation) < 10.0.14393.9060
Windows Server 2016 < 10.0.14393.9060
Windows 10 Version 1607 for x64-based Systems < 10.0.14393.9060
Windows 10 Version 22H2 for 32-bit Systems < 10.0.19045.7184
Windows 10 Version 22H2 for ARM64-based Systems < 10.0.19045.7184
Windows 10 Version 22H2 for x64-based Systems < 10.0.19045.7184
Windows 10 Version 21H2 for x64-based Systems < 10.0.19044.7184
Windows 10 Version 21H2 for ARM64-based Systems < 10.0.19044.7184
Windows 10 Version 21H2 for 32-bit Systems < 10.0.19044.7184
Windows Server 2022 (Server Core installation) < 10.0.20348.5020
Windows Server 2022 < 10.0.20348.5020
Windows 10 Version 1607 for 32-bit Systems < 10.0.14393.9060
Windows 11 Version 26H1 for ARM64-based Systems < 10.0.28000.1836
Windows 11 version 26H1 for x64-based Systems < 10.0.28000.1836
Windows Server 2025 < 10.0.26100.32690
Windows 11 Version 24H2 for x64-based Systems < 10.0.26100.8246
Windows 11 Version 24H2 for ARM64-based Systems < 10.0.26100.8246
Windows Server 2022, 23H2 Edition (Server Core installation) < 10.0.25398.2274
Windows 11 Version 23H2 for x64-based Systems < 10.0.22631.6936
Windows 11 Version 23H2 for ARM64-based Systems < 10.0.22631.6936
Windows 11 Version 25H2 for x64-based Systems < 10.0.26200.8246
Windows 11 Version 25H2 for ARM systems < 10.0.26200.8246
Windows Server 2025 (Server Core installation) < 10.0.26100.32690
Windows Server 2019 (Server Core installation) < 10.0.17763.8644
Windows Server 2019 < 10.0.17763.8644
Windows 10 Version 1809 for x64-based Systems < 10.0.17763.8644
Windows 10 Version 1809 for 32-bit Systems < 10.0.17763.8644
三、修复建议
官方已发布安全补丁，请及时更新：https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33829