Windows NFS Client EUVD-2026-99669

Exploitation requires the optional Windows 'Client for NFS' feature/role to be installed and reachable from the attacker's context - it is not enabled by default on most Windows client or server installations, which materially limits the exploitable population. The attacker must already have local, authenticated low-privilege code execution on the target host (CVSS PR:L, AV:L); there is no remote or network-facing exploitation path and no user interaction is needed (UI:N). The primary limiting factors are therefore the need for a pre-existing local foothold and the presence of the non-default NFS client component; hosts where this feature is absent are not exploitable via this flaw.

This is a credible but not top-priority local privilege-escalation issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable flaw requiring an attacker to already hold low-privilege authenticated access to the host, with low attack complexity and no user interaction, yielding total compromise (C:H/I:H/A:H) of the affected system once triggered. The CISA SSVC framework aligns with a measured posture: Exploitation=none (no observed exploitation), Automatable=no (consistent with a local vector that cannot be mass-scanned/wormed), but Technical Impact=total (consistent with the full C/I/A loss in the CVSS vector). No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The CVE is NOT listed in CISA KEV and no public proof-of-concept is indicated, so this should be treated as a patch-on-normal-cycle elevation-of-privilege bug rather than an emergency: real priority is moderate, elevated mainly where low-privilege users share a host (multi-user servers, terminal/RDP hosts) or as a post-exploitation step in a chain. No signals conflict - the local vector, SSVC 'Automatable: no', and absence of KEV/POC are mutually consistent.

A local, low-privileged authenticated user (or malware running in that context) on a Windows system with the Client for NFS feature installed invokes the vulnerable NFS client code path with crafted input that triggers the integer overflow (CWE-190), corrupting memory to run code at a higher privilege level and gain SYSTEM-level control of the machine. No user interaction and no network position is required, but the attacker must already have a foothold on the host. No public exploit code is identified at time of analysis.