Windows NFS EUVD-2026-56467

The Windows NFS Server role (Services for NFS / FS-NFS-Service) must be explicitly installed and running - this is not enabled by default in Windows Server or Windows 10 installations and requires deliberate administrator configuration. Exploitation requires network reachability to NFS service ports (TCP/UDP 2049 and the RPC portmapper on TCP/UDP 111). The CVSS vector confirms no authentication is required and no user interaction is needed. Limiting factors include: the NFS role being off by default significantly reduces the exposed population; SSVC rates the vector as not automatable, suggesting reliable exploitation is not trivially scriptable; and impact is limited strictly to availability - confidentiality and integrity are unaffected, ruling out data exfiltration or code execution scenarios.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a high-severity, unauthenticated network-reachable availability impact. However, several signals substantially moderate real-world urgency. EPSS is 0.65% at the 48th percentile, indicating below-average likelihood of exploitation activity relative to the broader CVE corpus. SSVC assessment designates exploitation as 'none' and automatable as 'no' - the latter is in mild tension with CVSS AC:L/PR:N, suggesting that while no privilege is required, reliable exploitation may require protocol-specific knowledge or timing that reduces automation potential. Technical impact is rated 'partial' by SSVC, consistent with the DoS-only impact scope. The vulnerability is not listed in CISA KEV and no POC has been identified. Taken together, this is a credible but lower-urgency finding: real risk exists for organizations running Windows NFS in network-exposed configurations, but mass exploitation is not currently observed. Priority should be elevated for internet-exposed NFS servers or environments where NFS availability is operationally critical.

A remote unauthenticated attacker on the same network segment - or reachable over the internet if NFS ports are exposed - sends a crafted NFS protocol message containing a malformed length or field value designed to trigger the buffer over-read in the Windows NFS parser. The service reads beyond the intended buffer boundary, encounters an access violation or exception, and crashes, rendering all NFS-dependent file shares unavailable until the service or server is restarted. No public proof-of-concept code has been identified at time of analysis.