Windows NFS EUVD-2026-100341

Exploitation requires the target to have the Windows Network File System (NFS) role/service enabled and reachable by the attacker, plus an existing low-privileged authenticated local account (PR:L, AV:L) on the host. The high attack complexity (AC:H) is a significant limiting factor: the out-of-bounds read likely depends on winning a race or on a specific, non-deterministic memory state, so reliable triggering requires repeated attempts. No user interaction is needed (UI:N). Hosts without the NFS role installed, and environments that deny untrusted users local/authenticated access, are not exposed.

This is a moderate-severity local elevation-of-privilege issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 High) tells a consistent story with the description: an attacker needs local access and an existing low-privileged account (PR:L), and exploitation is hard (AC:H), typically implying a race condition or non-deterministic memory-layout dependency for the out-of-bounds read (CWE-125). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are therefore not conflicting - they uniformly point to a locally-exploitable, hard-to-trigger EoP that matters most on multi-user or shared hosts where untrusted users already have a foothold. One nuance to verify: the root cause is an out-of-bounds READ (an information-disclosure primitive), yet Microsoft rated full I:H/A:H and classed it as EoP; this suggests the leaked memory (e.g., pointers/tokens) is chained into privilege escalation rather than the read alone granting integrity/availability impact - confirm the exploitation path with Microsoft's advisory. Prioritize patching on NFS-enabled, multi-tenant servers; deprioritize relative to any network-reachable, unauthenticated flaws.

A low-privileged but authenticated user on a Windows host running the Network File System (NFS) role repeatedly issues crafted NFS operations to trigger an out-of-bounds read, leaking adjacent kernel/service memory. Because attack complexity is high (AC:H), the attacker must win a race or hit a specific memory condition across multiple attempts, then use the disclosed data to escalate to higher privileges. No public exploit code is identified at time of analysis.