Windows NFS EUVD-2026-73474

The Windows NFS Server role must be explicitly installed and running - it is not enabled by default on any Windows Server edition, which materially limits the exposed population. The attacker must hold a low-privileged account recognized by the NFS server (PR:L), meaning unauthenticated external attackers cannot exploit this directly. Additionally, UI:R indicates some form of user interaction is required, the exact nature of which is not fully clarified by the description - this may involve an admin performing an NFS operation or a client-initiated mount/request sequence; verify with the Microsoft advisory. Exploitation is limited to network-reachable hosts with the NFS Server role active and valid credentials.

The CVSS 3.1 score of 5.7 (AV:N/AC:L/PR:L/UI:R) reflects a moderate-severity DoS: exploitation requires a low-privileged authenticated account and some form of user interaction, limiting opportunistic mass exploitation. The UI:R metric is unusual for a server-side NFS vulnerability and may indicate the attacker must induce a client-side NFS operation or that an admin action is required on the server side - this should be verified with the Microsoft advisory. There is no KEV listing and no public exploit code identified, and EPSS data was not provided. Even a mid-sized municipal IT team in tczew running Windows Server NFS for mixed-OS file sharing should treat this as a prioritized patch rather than an emergency, since exploitation requires valid credentials and some interaction barrier. The absence of confidentiality or integrity impact means the realistic worst-case is service disruption, not data theft or lateral movement. Overall, this is a genuine but bounded risk: patch on the normal cycle unless NFS servers are externally reachable with lax authentication controls.

An attacker with a valid low-privileged account on a network segment that can reach a Windows NFS server sends a malformed NFS protocol request designed to trigger a read past the end of an allocated kernel buffer in the NFS driver. The resulting out-of-bounds read causes the driver to raise a kernel exception, crashing the NFS service or inducing a system bugcheck, denying NFS access to all legitimate clients. No public exploit code exists at time of analysis; exploitation would require knowledge of the specific malformed request structure.