Windows NFS Driver CVE-2026-70585

Exploitation requires an authorized local attacker with at minimum low-privilege Windows credentials (PR:L) on the target system - anonymous or unauthenticated access is insufficient. The Windows Services for NFS role, specifically the ONCRPC XDR Driver component, must be installed and active on the target system; this is not a default Windows Server configuration and must have been explicitly enabled by an administrator. Successful exploitation additionally requires satisfying a high-complexity timing condition (AC:H), consistent with a race condition in kernel memory management. These two constraints - non-default NFS role deployment and a race-condition exploit primitive - significantly limit opportunistic exploitation.

The CVSS 7.0 base score with AV:L/AC:H/PR:L reflects a local, authenticated, complexity-gated attack. Real-world risk is moderate: exploitation requires an attacker with an existing low-privilege foothold on the target server and must reliably trigger a timing-sensitive kernel heap condition. The full C:H/I:H/A:H impact means successful exploitation yields complete system compromise. EPSS data is not present in available intelligence; KEV status is not listed, and no public PoC has been identified at time of analysis - these factors collectively lower the immediate exploitation urgency. However, the breadth of affected Windows Server versions (2012 through 2025) significantly widens the attack surface. The optional nature of the Windows NFS role meaningfully limits real-world exposure: systems that have not enabled Services for NFS are not affected. The 'Denial Of Service' tag may reflect a secondary crash path in failed exploitation attempts rather than the primary intended impact, which is code execution.

An attacker who has obtained a low-privilege user account on a Windows Server instance running the NFS role (e.g., via phishing, credential stuffing, or lateral movement) sends carefully timed RPC requests to the ONCRPC XDR driver to trigger a race condition that frees a kernel object while another thread still holds a pointer to it. By shaping kernel heap layout to control what occupies the freed region, the attacker redirects execution to attacker-controlled code running at kernel privilege, achieving full system compromise. No public PoC has been identified at time of analysis, so reliable exploitation would require significant kernel exploit development effort.