EUVD-2026-73797
GHSA-xfjp-65r5-5w3m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed NFS/ONC RPC endpoint
-
DeliverySend crafted XDR-encoded RPC request
-
ExploitTrigger use-after-free in ONCRPC XDR driver
-
ExecutionCorrupt and reclaim freed kernel object
-
ImpactExecute arbitrary code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target Windows Server to have the Services for NFS role installed and enabled with the ONC RPC/NFS network endpoints (portmapper 111, NFS 2049) reachable by the attacker - this role is not enabled by default, which is the principal limiting factor. Given that role is present, the CVSS vector indicates no further prerequisites: unauthenticated (PR:N), no user interaction (UI:N), low complexity (AC:L) network exploitation. Exploitation is also constrained by the difficulty of turning a kernel use-after-free into reliable code execution against modern Windows kernel mitigations. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes an unauthenticated, low-complexity, no-interaction network attack yielding full confidentiality, integrity, and availability impact - worst-case on paper, and credible given a kernel-mode driver target. No EPSS score, KEV listing, or public POC was supplied, so there is no evidence of active exploitation; this is a high-severity-by-CVSS issue whose real-world exploitability is tempered by two factors: use-after-free bugs in hardened Windows kernel drivers are non-trivial to weaponize into reliable RCE, and the vulnerable code path only exists when the optional Services for NFS role is installed and reachable. The provided Tags include 'Denial Of Service,' but the description explicitly states code execution, so RCE - not DoS - is the primary impact; treat the CVSS as the authoritative severity signal. Net: real priority for any server running the NFS role, lower urgency where that role is absent. |
| Exploit ScenarioDerived | An attacker who can reach a Windows Server's NFS/ONC RPC ports sends a specially crafted XDR-encoded RPC request that drives the ONCRPC XDR driver into a use-after-free, corrupting kernel memory and executing attacker code with system privileges - no credentials or user interaction needed. No public exploit is currently known, but the unauthenticated network vector makes internet- or LAN-exposed NFS servers attractive targets once tooling emerges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Remote code execution in the Windows Services for NFS ONCRPC XDR driver allows an unauthenticated network attacker to execute arbitrary code by triggering a use-after-free (CWE-416) in the driver that parses ONC RPC/XDR-encoded NFS traffic. All supported Windows Server releases (2012 through 2025, including Server Core) are affected when the Services for NFS role is enabled, and Microsoft rates it critical (CVSS 9.8). No public exploit has been identified at time of analysis and it is not on CISA KEV, but the unauthenticated network vector and kernel-mode driver target make it a high patch priority.
RemediationAI
Apply the Microsoft security update for CVE-2026-78445 per the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78445), upgrading to at least the fixed build for your release: 6.2.9200.26349 (2012), 6.3.9600.23397 (2012 R2), 10.0.14393.9512 (2016), 10.0.17763.9245 (2019), 10.0.20348.5622 (2022), or 10.0.26100.33438 (2025). Where patching cannot be scheduled immediately, reduce exposure by disabling or uninstalling the Services for NFS role on servers that do not require it (this stops NFS interoperability for Unix/Linux clients), or restrict access to the NFS/ONC RPC ports (portmapper TCP/UDP 111 and NFS TCP/UDP 2049) at the host and network firewall to trusted management or client subnets only - trade-off being that legitimate NFS clients outside those ranges lose access. There is no non-network workaround for the parsing flaw itself, so patching is the durable fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 11 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the ONCRPC XDR driver component of Windows Services for NFS, the optional Windows Server role that provides an NFS server/client for interoperability with Unix/Linux clients. ONC RPC (Open Network Computing Remote Procedure Call) uses XDR (External Data Representation) to serialize the data structures exchanged in NFS requests; the kernel-mode driver decoding this data mismanages an object's lifetime, freeing memory that is subsequently reused (CWE-416 use-after-free). Because parsing occurs in a network-facing driver before authentication, a crafted RPC/XDR stream can corrupt kernel memory. Affected builds per EUVD include Windows Server 2012 (6.2.9200 <6.2.9200.26349), 2012 R2 (6.3.9600 <6.3.9600.23397), 2016 (10.0.14393 <10.0.14393.9512), 2019 (10.0.17763 <10.0.17763.9245), 2022 (10.0.20348 <10.0.20348.5622), and 2025 (10.0.26100 <10.0.26100.33438), each with matching Server Core builds.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network parsing bug in a kernel driver yields full system compromise, but only where the non-default NFS role is enabled (exposure limit, not a base-metric change).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network.
Articles & Coverage 2
Executive ViewAI
An unauthenticated kernel-level vulnerability in the Windows NFS driver exposes all supported Server versions (2012-2025) to network-based exploitation enabling complete system compromise without user interaction or authentication. Organizations with Services for NFS enabled across their server infrastructure face heightened risk of unauthorized code execution at the highest privilege level.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB