Executive brief
Windows Network File System (NFS) contains a heap buffer overflow vulnerability that allows an attacker on the network to execute arbitrary code without authentication. This could enable attackers to gain complete control of affected systems, leading to data theft, system compromise, and lateral movement within corporate networks.
Technical details
A heap-based buffer overflow exists in the Windows Network File System implementation. The vulnerability can be triggered remotely without authentication by sending specially crafted network packets. An attacker can exploit this flaw to overwrite heap memory and achieve remote code execution with system-level privileges. The vulnerability has a CVSS score of 8.8, reflecting the high severity of network-accessible code execution.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed