EUVD-2026-44260
GHSA-6qff-8m44-xgj8
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable NFS with race-condition timing gives AV:N/AC:H, an authenticated NFS user gives PR:L, and privilege elevation yields full C:H/I:H/A:H within an unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Time-of-check time-of-use (toctou) race condition in Windows Network File System allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Elevation of privilege in the Windows Network File System (NFS) component affects a broad range of Microsoft platforms - Windows 10 (1607 through 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025 - where an authorized attacker can win a time-of-check/time-of-use (TOCTOU) race condition over the network to gain higher privileges. The CVSS 3.1 vector (AV:N/AC:H/PR:L) indicates a network-reachable but high-complexity flaw requiring low-level existing privileges, with full high impact to confidentiality, integrity and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a Microsoft (MSRC) patch is available.
Technical ContextAI
Windows NFS is Microsoft's implementation of the Network File System protocol, provided via the optional Server for NFS / Client for NFS roles that let Windows and UNIX/Linux hosts share files. The root cause is CWE-367 (Time-of-check Time-of-use race condition): the NFS service validates a resource, permission, or file state at one moment (the 'check') but the actual operation (the 'use') happens later, and an attacker who alters the state in the intervening window can subvert the security decision. Because NFS handles requests concurrently over the network, the window between validation and use is exploitable by a remote client that can precisely time overlapping operations, allowing a privilege boundary to be crossed.
RemediationAI
Apply the Microsoft security update for CVE-2026-56648 for each affected OS build; the patch is available per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56648, which provides the exact fixed build numbers per platform (Vendor-released patch: see MSRC update guide - no single global version applies across all builds). Because exact fix versions vary by product, use the advisory's per-build KB numbers rather than an invented version. As a compensating control on unpatched systems, disable the Server for NFS role where NFS sharing is not required (side effect: breaks any legitimate NFS file shares to UNIX/Linux clients), and restrict NFS access at the network layer by limiting TCP/UDP 2049 (and portmapper/mountd ports) to trusted client subnets via firewall rules (side effect: may block legitimate cross-platform clients). Since PR:L is required, also review and tighten NFS export permissions and authenticated user accounts to reduce the pool of potential attackers.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today