CVE-2026-118141: Windows Client for NFS: Remote code…

Summary

Windows Client for NFS, the Windows feature for mounting NFS exports, contains a stack-based buffer overflow (CWE-121). A network attacker can execute code on affected Windows hosts, with a CVSS 3.1 score of 8.8, but user interaction is required. The risk is mainly relevant where the NFS client is installed and used, and CISA SSVC rates exploitation as none.

Affected

Windows 10 Version 1607, 1809, 21H2 and 22H2
Windows 11 Version 23H2, 24H2, 25H2, 26H1 and 26H2
Windows Server 2016, 2019 and 2022 (including Server Core installations)

Windows Server 2025 is not listed in the CNA record.

Fixed in

Windows 10 1607 / Server 2016: 10.0.14393.9688
Windows 10 1809 / Server 2019: 10.0.17763.9487
Windows 10 21H2: 10.0.19044.7846
Windows 10 22H2: 10.0.19045.7846
Windows 11 23H2: 10.0.22631.7711
Windows 11 24H2: 10.0.26100.9974
Windows 11 25H2: 10.0.26200.9974
Windows 11 26H1: 10.0.28000.3501
Windows 11 26H2: 10.0.26300.9974
Windows Server 2022: 10.0.20348.5870
Windows Server 2025: Unknown.

Build numbers are taken from the CNA record and must be verified against the MSRC advisory.

Workaround

Unknown. No vendor mitigation was found.
If NFS mounts are not needed, remove or disable the Windows NFS client feature.
Restrict which NFS servers hosts can reach.

Exploitation

CNA exploit maturity: unproven (E:U).
CISA SSVC: exploitation none, not automatable.
No public proof of concept or exploit was found. The CISA KEV catalogue was not checked directly.

Our recommendation

Install the November 2026 cumulative update on affected hosts, prioritising hosts that use NFS mounts.
Check whether Windows hosts have the NFS client feature installed and whether it is needed.
Disable the feature where it is unused and restrict access to NFS servers.
Check the vendor support status of older builds (1607, 1809).
Re-check the MSRC advisory, NVD and CISA KEV once analysis is published.

Information from Microsoft (Patch Tuesday November 2026)

Severity (Microsoft): Important
Impact: Remote code execution – Windows Client for NFS
Status on Patch Tuesday: Neither exploited nor publicly disclosed
Exploitability assessment: Exploitation unlikely
Product family: Windows, Windows ESU (Extended Security Updates)
Updates (KB): KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Microsoft Security Update Guide: CVE-2026-118141 msrc.microsoft.com
CVE Program record: CVE-2026-118141 www.cve.org
Strix: CVE-2026-118141 (unverified build list) www.strix.ai
Senserva KB 5132061 (unverified) senserva.com
Senserva KB 5131096 (unverified) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 22:30.

Original description (NVD)

Stack-based buffer overflow in Windows Client for NFS allows an unauthorized attacker to execute code over a network.

NVD references (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118141

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed