EUVD-2026-73085
GHSA-pxrj-qg32-c99w
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local kernel UAF requiring heap grooming race condition (AC:H); low-privilege user account needed (PR:L); full kernel-mode impact if exploited (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Windows Services for NFS ONCRPC XDR Driver allows an authorized attacker to execute code locally.
AnalysisAI
Local code execution in the Windows Services for NFS ONCRPC XDR Driver via a use-after-free (CWE-416) allows a low-privileged local attacker to achieve full system compromise (C:H/I:H/A:H) on all supported Windows Server releases from 2012 through 2025. Exploitation is constrained by high attack complexity (AC:H), typical of race-condition UAF primitives in kernel drivers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authorized local attacker with at minimum low-privilege Windows credentials (PR:L) on the target system - anonymous or unauthenticated access is insufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.0 base score with AV:L/AC:H/PR:L reflects a local, authenticated, complexity-gated attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Microsoft's monthly cumulative update addressing this vulnerability: Windows Server 2012 to build 6.2.9200.26349 or later, Windows Server 2012 R2 to 6.3.9600.23397 or later, Windows Server 2016 to 10.0.14393.9512 or later, Windows Server 2019 to 10.0.17763.9245 or later, Windows Server 2022 to 10.0.20348.5622 or later, and Windows Server 2025 to 10.0.26100.33438 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Windows Server 2012-2025 systems with Windows Services for NFS enabled and document which applications or workflows depend on NFS functionality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today