Executive brief
Windows Services for NFS is a networking component that enables Windows systems to communicate with NFS (Network File System) servers commonly found in Unix/Linux environments. A use-after-free vulnerability in the ONCRPC XDR driver allows an authorized local attacker to execute arbitrary code with elevated privileges, potentially compromising system integrity and enabling lateral movement within a network.
Technical details
The vulnerability is a use-after-free flaw in the ONCRPC XDR (eXternal Data Representation) driver component of Windows Services for NFS. The vulnerability requires authentication and local access to exploit; an authorized user can trigger the use-after-free condition through specially crafted NFS protocol interactions, leading to arbitrary code execution in kernel context. The root cause involves improper memory management when handling XDR data structures. An attacker with local system access can leverage this to gain kernel-level code execution and bypass security boundaries. Microsoft has released security updates to address this issue through their standard patch cycle.
Affected products
- Microsoft Windows Services for NFS
Timeline
- 2026-09-08: disclosed