Windows NFS Portmapper EUVD-2026-73094

Exploitation requires: (1) an existing low-privileged local user account on the target machine (PR:L per CVSS); (2) the Windows Services for NFS role must be installed and the NFS Portmapper service must be running - this is a non-default, explicitly installed Windows feature; (3) local execution context (AV:L), meaning network-only attackers cannot exploit this directly. Limiting factors: no remote exploitation path exists; the attacker must already have authenticated local access; the NFS feature is opt-in and not present on typical workstations or servers that have not configured NFS file sharing. These conditions substantially constrain the realistic attacker population compared to a remotely exploitable vulnerability.

Real-world risk is meaningful but bounded by the local-only attack vector. CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) accurately reflects that exploitation requires an existing foothold on the target machine - a network-based attack path is not described. Once that foothold exists, however, the low complexity and complete C/I/A impact make this a reliable privilege escalation stepping stone in post-exploitation chains. The absence of a CISA KEV entry and no reported public POC reduce urgency relative to a remotely exploitable flaw, but organizations running NFS Portmapper on Windows - particularly file-server infrastructure in multi-tenant or shared environments - should treat patching as a standard priority patch-cycle item. The breadth of affected versions (19 distinct version/build combinations spanning Server 2012 through Windows 11 26H1) means the patch surface is wide, and even a mid-sized enterprise IT team should treat this as a routine but time-bound remediation obligation given the attacker-controlled post-compromise escalation potential. EPSS data was not provided; exploitation probability from that signal is unknown. No KEV listing, no confirmed POC - no public exploit identified at time of analysis.

A low-privileged user with a local session on a Windows Server running the Services for NFS role authenticates to the system via RDP or console access, then sends a malformed RPC request to the NFS Portmapper service that triggers the heap buffer overflow. By controlling heap layout and exploiting the overflow to corrupt a function pointer or heap metadata, the attacker redirects execution to attacker-supplied code running as SYSTEM. No public POC exists at time of analysis, but the CWE-122 class is well-understood and reliable primitives for Windows heap exploitation are documented in public research.