Windows Client for NFS: Heap-based buffer overflow enables local privilege escalation

Summary

A heap-based buffer overflow in the Windows Client for NFS component allows an authorized local user to elevate privileges. The CVSS base score is 7.8 (High), and the vector requires local access with low privileges and no user interaction. Remote exploitation is not possible, but multi-user systems, terminal servers and shared machines carry the highest risk.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9612)
• Windows 10 Version 1809 (builds before 10.0.17763.9376)
• Windows 10 Version 21H2 (builds before 10.0.19044.7807)
• Windows 10 Version 22H2 (builds before 10.0.19045.7807)
• Windows 11 Version 23H2 (builds before 10.0.22631.7652)
• Windows 11 Version 24H2 (builds before 10.0.26100.9711)
• Windows 11 Version 25H2 (builds before 10.0.26200.9711)
• Windows 11 Version 26H1 (builds before 10.0.28000.3231)
• Windows 11 Version 26H2 (builds before 10.0.26300.9711)
• Windows Server 2012 and Server Core (builds before 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core (builds before 6.3.9600.23470)
• Windows Server 2016 (builds before 10.0.14393.9612)

Fixed in

Install the October 2026 Microsoft security update for each affected version. Fixed builds according to the CNA data: 10.0.14393.9612 (1607 and Server 2016), 10.0.17763.9376 (1809), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2), 6.2.9200.26434 (Server 2012), 6.3.9600.23470 (Server 2012 R2). Verify the exact fixed build for each system on the MSRC Security Update Guide.

Workaround

• No workaround is needed where the security update is installed.
• Optional hardening if the NFS client is not required: disable or uninstall the Windows Client for NFS feature. This is not a confirmed Microsoft mitigation.
• Limit local logon rights on shared machines and terminal servers.

Exploitation

• Microsoft lists exploitation as "No" and reports no publicly available exploit code.
• CISA SSVC data records exploitation as "none" and automatable as "no".
• EPSS is 0.00333 at the time of research.
• No public PoC or KEV listing was found. Unknown whether exploitation has occurred since the last check.

Our recommendation

• Inventory all Windows systems, including any Windows 10 1607 or Server 2012 hosts, and check which have the Windows Client for NFS feature enabled.
• Install the October 2026 cumulative update on all affected systems, prioritizing multi-user machines, terminal servers and systems with NFS mounts.
• Plan the replacement of unsupported systems (such as Windows 10 1607) instead of relying on the patch alone.
• Limit local accounts and monitor for unusual privilege changes on shared systems.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-69949 msrc.microsoft.com
• Microsoft Security Update Guide (en-US): CVE-2026-69949 msrc.microsoft.com
• Vulners: NVD record CVE-2026-69949 vulners.com
• Vulners: CVE List record CVE-2026-69949 vulners.com
• OpenCVE: CVE-2026-69949 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:41.