Windows NFS Client EUVD-2026-99665

Exploitation requires the optional 'Client for NFS' Windows feature (Services for NFS) to be installed/enabled - it is not present in a default Windows configuration - and requires user interaction (UI:R): the victim must initiate a connection to or mount a share from an attacker-controlled or malicious NFS server that returns crafted protocol responses. No authentication is needed (PR:N), and the vector is network-based (AV:N). Limiting factors are the mandatory user interaction, the non-default NFS client feature, and the confidentiality-only impact (no code execution or data modification), which together substantially narrow realistic exploitation.

This is a moderate-severity information-disclosure flaw, not an urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity, unauthenticated attack, but it is gated by UI:R - the victim must be induced to interact (e.g., mount or connect to an attacker-controlled NFS resource), which meaningfully limits mass exploitation. Impact is confidentiality-only (C:H, I:N, A:N): an out-of-bounds read (CWE-125) can leak memory contents but cannot alter data or crash the service. The signals are consistent and point to low real-world urgency: CISA's SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'; there is no CISA KEV listing and no public exploit identified. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be factored in - treat that as a data gap. One caveat worth verifying with the vendor: the input tags label this a 'Buffer Overflow', which conflicts with CWE-125 (out-of-bounds read); the CWE and description should be treated as authoritative over the tag.

An attacker stands up a malicious or compromised NFS server and lures a victim running Windows Client for NFS into connecting to it. Crafted NFS protocol responses trigger an out-of-bounds read in the client, causing it to return adjacent process memory to the attacker-influenced flow and disclosing potentially sensitive data. No public exploit code has been identified at the time of analysis, and exploitation requires user interaction, so this is opportunistic rather than wormable.