Windows Network File System CVE-2026-56650

Exploitation requires the attacker to already possess low-level local privileges on the host (PR:L) and the ability to run code that reaches the Windows NFS code path; no user interaction is needed (UI:N). The affected component is the Windows Network File System, so hosts with the Server for NFS role installed/enabled are the meaningful targets - systems without the NFS feature present a much smaller or nonexistent attack surface. Limiting factors: the vector is Local (AV:L), not remote, so an initial foothold is a hard prerequisite; scope is Unchanged (S:U); and it applies to the enumerated Windows 10/11 and Server 2012-2025 builds. This is a privilege-escalation building block, not a standalone remote entry point.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8, High) describes a local, low-complexity, low-privilege escalation with no user interaction and full confidentiality/integrity/availability impact - a textbook SYSTEM-privilege EoP. Because the attack vector is Local (AV:L) and requires existing low privileges (PR:L), this is a second-stage vulnerability: an attacker must already have a foothold. No EPSS score, POC, or SSVC decision data was provided, and the CVE is not in CISA KEV, so there is no evidence of active or automatable exploitation - this is a real patch priority for systems with the NFS role, but not an internet-facing, wormable emergency. Note a nuance: NFS is fundamentally a network file service, yet the vector is AV:L; this likely reflects Microsoft scoring the exploitable trigger as requiring local code execution rather than a remote NFS request - verify against the MSRC advisory if remote reachability is a concern.

An attacker who has already gained low-privileged code execution on a Windows host - for example via a phished user session or a compromised low-privilege service account - invokes the vulnerable NFS code path to overflow a heap buffer and corrupt kernel/service memory, gaining SYSTEM. No public exploit is identified at time of analysis, so this would require custom exploit development, and the low attack complexity (AC:L) suggests reliable exploitation is achievable once the primitive is understood.