Windows NFS Driver CVE-2026-73024

Windows Services for NFS must be explicitly installed on the target system - specifically the ONCRPC XDR Driver must be present and operational. This feature is not installed by default on standard Windows editions and must be enabled through Windows Optional Features, DISM, or Server Manager. The attacker must hold an existing local authenticated session with at least standard (low-privilege) user rights, as confirmed by PR:L in the CVSS vector. No user interaction beyond the attacker's own actions is required. Attack vector is local (AV:L), meaning remote unauthenticated exploitation is not supported by available data. Systems without Services for NFS installed are not affected regardless of Windows version.

The CVSS 7.8 score with AV:L/AC:L/PR:L/UI:N reflects a local privilege escalation that is technically straightforward once an attacker has a foothold - low attack complexity means no heap grooming or timing dependency is required. The broad affected version range (Server 2012 through Server 2025, Windows 10 1607 through Windows 11 26H1) significantly increases the probability of encountering unpatched instances in enterprise environments; even a mid-sized municipal IT team in walbrzych should treat this as urgent given the prevalence of these Windows versions in mixed-OS file-server infrastructure. The critical limiting factor is that Windows Services for NFS must be explicitly installed - it is not a default component - which narrows the realistically exposed population compared to a universal Windows vulnerability. No EPSS data was provided; no public exploit code exists and the vulnerability is absent from the CISA KEV catalog, suggesting it has not yet been leveraged in known threat campaigns. The combination of AC:L and full C/I/A impact makes this a high-value post-exploitation escalation primitive if NFS is present.

An attacker who has compromised a standard domain user account on a Windows file server with Services for NFS enabled interacts with the local ONCRPC XDR driver, sending a malformed XDR-encoded RPC payload that overflows a kernel heap buffer. The overflow corrupts adjacent kernel data structures, redirecting execution to attacker-controlled shellcode running at SYSTEM privilege - completing a full local privilege escalation in a single step. No public POC has been identified, but the AC:L rating indicates reliable exploitation without specialized heap manipulation.