Windows NFS Client EUVD-2026-99663

Requires the optional 'Client for NFS' (Services for NFS client) feature to be installed and enabled on the target Windows host - this is NOT present in a default Windows installation, which substantially limits the exposed population. Per CVSS UI:R, exploitation also requires user interaction: the victim must initiate or be induced to connect to / mount an attacker-controlled or spoofed NFS resource, so the attacker cannot trigger the OOB read purely remotely without that connection. No authentication is required on the target (PR:N). Impact is limited to disclosure of process memory (C:H, I:N/A:N) - no code execution, integrity, or availability loss.

This is a moderate-severity information-disclosure flaw (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) rather than a top-tier priority. The signals are internally consistent and point AWAY from urgent patching: although the CVSS vector is network-based and unauthenticated (PR:N), it requires user interaction (UI:R), and impact is confined to confidentiality (C:H/I:N/A:N) with scope unchanged. CISA's SSVC framework reinforces low urgency - Exploitation: none, Automatable: no, Technical Impact: partial. There is no CISA KEV listing and no public exploit identified. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The 'Buffer Overflow' tag is somewhat misleading: the underlying weakness is CWE-125 (out-of-bounds READ) driving disclosure, not a memory-corruption/RCE overflow, so the tag should not be read as implying code execution. Net: a real but low-priority issue - a memory-disclosure bug requiring the victim to interact with an attacker-controlled NFS resource, best handled in normal Patch Tuesday cadence.

An attacker stands up a malicious NFS server (or spoofs responses to an existing share) and lures a Windows host running the Client for NFS into connecting to it. Crafted NFS responses trigger an out-of-bounds read in the client, leaking adjacent process memory back over the network to the attacker. No public exploit code has been identified at time of analysis.