Windows Client for NFS: Heap-based buffer overflow allows privilege escalation

Summary

A heap-based buffer overflow in the Windows Client for NFS component allows an authorized local attacker to elevate privileges. The CVSS base score is 7.8 (high), with high impact on confidentiality, integrity and availability. The attacker needs a local account with low privileges and no user interaction, so this is a post-compromise escalation risk rather than an internet-facing entry point. The component is only exposed on systems where the NFS client feature is installed.

Affected

• Windows 10 Version 1607 (builds 10.0.14393.0 to before 10.0.14393.9688)
• Windows 10 Version 1809 (builds 10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds 10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds 10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds 10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds 10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds 10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds 10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds 10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2016 incl. Server Core (builds 10.0.14393.0 to before 10.0.14393.9688)
• Windows Server 2019 incl. Server Core (builds 10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (builds 10.0.20348.0 to before 10.0.20348.5870)
• Note: the product list is taken from the CVE record and has not been verified against the MSRC advisory. Third-party sources disagree on some entries.

Fixed in

• Fixed in the security update that brings the affected builds to at least the first unaffected build listed above.
• KB numbers: Unknown.
• Verify the exact fixed build and KB for each product on the MSRC Security Update Guide before deployment.

Workaround

• Unknown. Microsoft has not published a CVE-specific workaround that could be verified.
• Sensible inference, not vendor guidance: if patching is not possible, disable the NFS client feature on systems that do not need it, or restrict who can start NFS operations.

Exploitation

• Exploited in the wild: Unknown. No reports found; CISA KEV and the MSRC exploited flag were not checked.
• Public proof-of-concept exploit: none found.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• CVSS temporal vector E:U (exploit code maturity unproven) in the CNA record.

Our recommendation

• Inventory whether the NFS client feature is installed on Windows 10, Windows 11 and Windows Server systems.
• Prioritise patching for hosts that use NFS, and for any host where local users are not fully trusted.
• Confirm the KB and fixed build on the MSRC page, then install the current cumulative update.
• Disable the NFS client feature on hosts that do not need it.
• Monitor for unusual local privilege escalation activity on affected systems.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-122165 msrc.microsoft.com
• CVE Record: CVE-2026-122165 www.cve.org
• Strix: CVE-2026-122165 (third-party, unverified) www.strix.ai
• Windows NFS client flaw guide (third-party, related NFS issues) windowsnews.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:28.