EUVD-2026-44264
GHSA-w2xr-m9cj-6q3w
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation from an existing low-privileged foothold (AV:L, PR:L), no user interaction, low complexity, yielding full SYSTEM-level C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Network File System allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Network File System (NFS) component allows an authenticated attacker to elevate to SYSTEM by triggering a heap-based buffer overflow (CWE-122). Reported by Microsoft and affecting a broad range of Windows 10, Windows 11, and Windows Server 2012-2025 releases, with a vendor patch available via MSRC. No public exploit identified at time of analysis, and no CISA KEV listing.
Technical ContextAI
The flaw resides in the Windows Network File System (NFS) subsystem, which implements the Sun RPC/ONC NFS protocol server that Windows Server can expose to allow UNIX/Linux clients to mount Windows-hosted shares. The root cause is CWE-122 (heap-based buffer overflow): memory allocated on the heap is written past its bounds, corrupting adjacent heap structures. NFS request parsing in kernel/driver context is a classic source of such overflows because attacker-influenced length or offset fields can drive undersized allocations or oversized copies. The CPE set spans microsoft:windows_10 (1607, 1809, 21H2, 22H2), windows_11 (24H2, 25H2, 26H1), and windows_server_2012 through 2025, indicating shared vulnerable NFS code across the servicing branches.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-56650 for each affected OS build via Windows Update / WSUS; consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56650 for the exact KB and patched build number per SKU (the input does not specify a single fix version, so use the MSRC per-product build). As a compensating control where patching must be deferred, disable or uninstall the Server for NFS role on hosts that do not require UNIX/Linux client interoperability (Remove-WindowsFeature FS-NFS-Service), which removes the vulnerable service entirely at the cost of breaking NFS exports; alternatively restrict local logon and code-execution rights on NFS-enabled servers to trusted admins to raise the bar for the required local foothold. Since exploitation is local (AV:L), tightening who can run code on the host meaningfully reduces exposure until the patch is applied.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today