Sign in Subscribe
Microsoft Corp.

Microsoft Disables File Explorer Preview Pane to Patch Critical Security Vulnerability

Strategic Insights

— 1 min read

Microsoft's latest patch on October 2025 Patch Tuesday has raised eyebrows among Windows users, as it deliberately disables the File Explorer preview pane for common file types, citing security concerns. This change, implemented in updates KB5066835 for Windows 11 and KB5066791 for Windows 10, is aimed at mitigating a vulnerability that could allow attackers to steal NTLM credential hashes.

Key Takeaways:

  • The File Explorer preview pane is disabled by default for files marked with the Mark of the Web (MotW), which indicates they originated from the internet Security Zone.
  • The change is aimed at preventing a vulnerability that could allow attackers to steal NTLM credential hashes by previewing malicious files.
  • Users can manually remove the Mark of the Web on a per-file basis to restore preview functionality, but this method may not be practical for frequent users.
  • An alternative method to restore previews for files on a network share is to add the file share's address to the Local intranet or Trusted sites security zones, but this approach may relax security posture for every file on that share.
  • The move signals a shift toward a "secure by default" posture, where operating system developers introduce user friction to close potential attack vectors.
  • IT administrators will need to balance centrally-managed security policies with employee productivity as a result of this change.

Statistics:

  • The vulnerability being patched is related to the NTLM suite of Microsoft security protocols, which can be exploited in a pass-the-hash attack.
  • The patch affects both Windows 11 and Windows 10, with updates KB5066835 and KB5066791, respectively.
  • The change is aimed at preventing NTLM hash leakage, which can occur if users preview files containing HTML tags referencing external paths.
  • According to Microsoft, preview functionality is disabled by default for files marked with Mark of the Web (MotW), which indicates they originated from the internet Security Zone.

Sources:

  • Microsoft official support documentation
  • CVE-2025-24054
  • KB5066835 (Windows 11 update)
  • KB5066791 (Windows 10 update)

Read more