Windows Network File System EUVD-2026-100343

Exploitation requires the Windows Network File System (NFS) server role/feature to be installed and running on the target host - this is NOT enabled in default Windows installations, which sharply limits the real-world attack surface. The attacker must already have local access and low-level authenticated privileges (PR:L) on the system, and must overcome high attack complexity (AC:H), indicating a race condition or a specific memory/timing state that is not reliably reproducible. No user interaction is required (UI:N). Impact is confined to local information disclosure (C:H only); there is no integrity or availability impact and no remote network vector.

This is a moderate-severity, low-priority information disclosure flaw (CVSS 4.7) that is unlikely to warrant emergency patching. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) is internally consistent and self-limiting: exploitation requires local access, already-held low privileges (PR:L, authenticated), and high attack complexity (AC:H), yielding only confidentiality impact (C:H) with no integrity or availability effect. All exploitation signals point toward low real-world risk: no EPSS score was provided, the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis. No SSVC decision data (exploitation status, automatable, technical impact) was supplied. The combination of local-only vector, required authentication, and high complexity makes automatable mass exploitation implausible; this reads as a defense-in-depth memory-safety fix rather than an active threat. Note the only reference is the Microsoft MSRC update-guide entry - no technical write-up, NVD enrichment, or EPSS/KEV telemetry is available to corroborate exploitability, so the assessment rests primarily on the CVSS vector and terse description.

A low-privileged local user on a Windows host running the Network File System role triggers an untrusted pointer dereference (CWE-822) in the NFS component, likely by supplying crafted input through an NFS interface, to read memory the attacker should not be able to access. The high attack complexity (AC:H) implies a race condition or precise memory-state requirement rather than a deterministic trigger, and no public exploit code is known to exist, so successful exploitation requires non-trivial effort.