EUVD-2026-73474
GHSA-4hmj-3fhx-q5v9
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
NFS is a network protocol (AV:N); attacker needs valid credentials (PR:L) and some interaction (UI:R); impact is availability-only DoS with no confidentiality or integrity effect.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
5DescriptionCVE.org
Out-of-bounds read in Windows Network File System allows an authorized attacker to deny service over a network.
AnalysisAI
Out-of-bounds read (CWE-125) in the Windows Network File System kernel component allows a low-privileged, authenticated network attacker with some form of user interaction to crash the NFS service, resulting in denial of service. Affected platforms span a wide range of Windows Server versions from Server 2012 through Server 2025, as well as Windows 10 (versions 1607 and 1809). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Windows NFS Server role must be explicitly installed and running - it is not enabled by default on any Windows Server edition, which materially limits the exposed population. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.7 (AV:N/AC:L/PR:L/UI:R) reflects a moderate-severity DoS: exploitation requires a low-privileged authenticated account and some form of user interaction, limiting opportunistic mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patches via Windows Update or WSUS targeting the fixed build numbers per platform: Server 2012 to 6.2.9200.26349 or later, Server 2012 R2 to 6.3.9600.23397 or later, Server 2016 to 10.0.14393.9512 or later, Server 2019 to 10.0.17763.9245 or later, Server 2022 to 10.0.20348.5622 or later, Server 2025 to 10.0.26100.33438 or later, and Windows 10 1607/1809 to their respective fixed builds. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allShare
External POC / Exploit Code
Leaving vuln.today