Skip to main content

Windows NFS EUVDEUVD-2026-56467

| CVE-2026-68819 HIGH
Buffer Over-read (CWE-126)
2026-08-11 secure@microsoft.com GHSA-x7cr-3chg-3844
Buffer Overflow Microsoft Windows 10 1607 Windows 10 1809 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Unauthenticated network-reachable DoS with no privilege or interaction required; only availability is impacted, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Updated
Aug 14, 2026 - 18:38 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 14, 2026 - 18:22 vuln.today
cvss_changed
Severity Changed
Aug 14, 2026 - 18:22 NVD
MEDIUM HIGH
CVSS changed
Aug 14, 2026 - 18:22 NVD
5.9 (MEDIUM) 7.5 (HIGH)
Analysis Generated
Aug 11, 2026 - 22:11 vuln.today
Patch available
Aug 11, 2026 - 18:19 EUVD
CVE Published
Aug 11, 2026 - 17:19 nvd
MEDIUM 5.9

DescriptionNVD

Buffer over-read in Windows Network File System allows an unauthorized attacker to deny service over a network.

AnalysisAI

Remote unauthenticated denial of service in Windows Network File System (NFS) allows a network attacker to crash the NFS service by sending a malformed packet that triggers a buffer over-read (CWE-126). Affected systems span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify exposed Windows NFS server
Delivery
Send crafted malformed NFS protocol message
Exploit
Trigger buffer over-read in NFS parser
Execution
NFS service crashes
Impact
Deny file share access to all clients
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The Windows NFS Server role (Services for NFS / FS-NFS-Service) must be explicitly installed and running - this is not enabled by default in Windows Server or Windows 10 installations and requires deliberate administrator configuration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a high-severity, unauthenticated network-reachable availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A remote unauthenticated attacker on the same network segment - or reachable over the internet if NFS ports are exposed - sends a crafted NFS protocol message containing a malformed length or field value designed to trigger the buffer over-read in the Windows NFS parser. The service reads beyond the intended buffer boundary, encounters an access violation or exception, and crashes, rendering all NFS-dependent file shares unavailable until the service or server is restarted. …
Remediation Apply the Microsoft-released patches for all affected build lines as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68819. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Windows Server 2012+ and Windows 10 1607/1809 systems in production, categorize by criticality based on NFS dependencies, and test Microsoft's patches in a non-production environment. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Windows 10 1607

View all
CVE-2021-40444 HIGH POC
8.8 Sep 15

Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
CVE-2021-34527 HIGH POC
8.8 Jul 02

<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
CVE-2022-30190 HIGH POC
7.8 Jun 01

Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
CVE-2018-8174 HIGH POC
7.5 May 09

The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
CVE-2021-1675 HIGH POC
7.8 Jun 08

Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
CVE-2023-36884 HIGH POC
7.5 Jul 11

Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2024-30088 HIGH POC
7.0 Jun 11

Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
CVE-2019-1458 HIGH POC
7.8 Dec 10

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

CVE-2018-8453 HIGH POC
7.8 Oct 10

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

CVE-2025-33053 HIGH POC
8.8 Jun 10

Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
CVE-2020-1054 HIGH POC
7.0 May 21

Elevation of privilege in the Windows Win32k kernel-mode driver allows a local, low-privileged attacker to escalate to S

Same weakness CWE-126 – Buffer Over-read

View all
CVE-2017-7668 HIGH
7.5
CVE-2017-7679 CRITICAL POC
9.8
CVE-2021-34584 CRITICAL POC
9.1
CVE-2022-1987 HIGH POC
8.1
CVE-2022-1908 HIGH POC
8.1
CVE-2022-1907 HIGH POC
8.1
CVE-2023-0817 HIGH POC
7.8
CVE-2022-3178 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8

Share

EUVD-2026-56467 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy