Microsoft Windows Client for NFS: Out-of-bounds read leads to information disclosure

Summary

An out-of-bounds read in the Windows Client for NFS component allows an unauthorized attacker to disclose information over the network. Microsoft states that an attacker could potentially read small portions of heap memory. Exploitation requires user interaction, and the flaw affects only systems with the Windows NFS client in use.

Affected

• Windows 10 Version 1607 (builds below 10.0.14393.9612)
• Windows 10 Version 1809 (builds below 10.0.17763.9376)
• Windows 10 Version 21H2 (builds below 10.0.19044.7807)
• Windows 10 Version 22H2 (builds below 10.0.19045.7807)
• Windows 11 Version 23H2 (builds below 10.0.22631.7652)
• Windows 11 Version 24H2 (builds below 10.0.26100.9711)
• Windows 11 Version 25H2 (builds below 10.0.26200.9711)
• Windows 11 Version 26H1 (builds below 10.0.28000.3231)
• Windows 11 Version 26H2 (builds below 10.0.26300.9711)
• Windows Server 2012 and 2012 R2 (builds below 6.2.9200.26434 and 6.3.9600.23470)
• Windows Server 2016 (builds below 10.0.14393.9612)

Fixed in

• Install the October 2026 security update from Microsoft for your Windows version.
• Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 or later.
• The KB number for Windows 10 Version 1607 was not found in the sources. Check the Microsoft Security Update Guide for the exact update.

Workaround

• If NFS access is not required, disable or uninstall the Windows NFS Client feature. This option is taken from the CVE record and is not confirmed in Microsoft's advisory text.

Exploitation

• Microsoft lists the flaw as publicly not disclosed and not exploited.
• Exploit code maturity is Unproven. No public proof of concept is known.
• CISA SSVC data lists exploitation as none and automatable as no.
• The EPSS score is about 1 percent.

Our recommendation

• Apply the October 2026 Microsoft update in the normal patch cycle, and prioritise devices that run the Windows NFS client.
• Check whether NFS client use is actually required. If not, disable the feature.
• Verify that Windows 10 Version 1607 devices still receive security updates. An unsupported build will not receive this fix.
• Restrict NFS traffic to trusted servers and monitor for unusual NFS connections.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-69940 msrc.microsoft.com
• NVD record via Vulners vulners.com
• CNA JSON via Vulners vulners.com
• OpenCVE: CVE-2026-69940 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 5 Nov 2026, 11:26.