Windows NFS Driver CVE-2026-83989

The Windows Services for NFS role (specifically the 'Server for NFS' component) must be installed and running on the target system - this is an optional Windows role not present in default Windows installations. The NFS service must be reachable from the attacker's network position over the standard ONC RPC ports (TCP/UDP 111 for portmapper, TCP/UDP 2049 for NFS). Exploitation is otherwise fully unauthenticated and requires no prior session or credentials. Limiting factors: the NFS role is absent on typical Windows workstations and many server deployments; network perimeter controls that restrict RPC/NFS traffic from untrusted segments would block exploitation even on exposed servers. The vulnerability does not affect confidentiality or integrity - impact is purely a kernel crash (denial of service).

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5 High) accurately reflects the attack profile: the exploit is fully unauthenticated and network-reachable with no complexity barrier, but impact is limited to availability (A:H) with no confidentiality or integrity compromise. Real-world priority depends heavily on deployment: Windows Services for NFS is an optional, non-default role, so only systems deliberately configured as NFS servers are exposed. In mixed Windows/Linux enterprise environments, NFS-enabled servers could be a meaningful attack surface - particularly where NFS ports (111/2049 TCP/UDP) are reachable from less-trusted network segments. No public exploit code exists and this is not in CISA KEV, indicating no confirmed active exploitation. EPSS data is not provided. The availability-only impact means this is primarily a denial-of-service concern; a successful attack would crash a Windows NFS server, potentially disrupting file-sharing services for connected Unix/Linux clients. Priority should be elevated for organizations using Windows NFS servers in production.

An attacker with network access to a Windows system running the NFS server role sends a crafted ONC RPC request containing a malformed XDR-encoded payload to the portmapper (TCP/UDP 111) or NFS service (TCP/UDP 2049). The ONCRPC XDR Driver attempts to parse the packet and performs an out-of-bounds memory read, triggering a kernel fault and causing a system crash (BSOD). The server becomes unavailable until manually rebooted, disrupting NFS file-sharing services for all connected clients. No public exploit code exists at time of analysis, but the network-accessible, unauthenticated nature of the attack makes it relatively straightforward to develop.