Windows Client for NFS: Use-after-free leading to remote code execution

Summary

A use-after-free vulnerability (CWE-416) in the Windows Client for NFS component allows an unauthorized attacker to execute code over a network. The CVSS vector rates user interaction as required (UI:R), and the impact on confidentiality, integrity and availability is high. The affected products are listed below; Microsoft's CNA record does not state the conditions for exploitation beyond this.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870

Fixed in

• Per the CVE record, the first fixed builds are: 10.0.14393.9688 (1607, Server 2016), 10.0.17763.9487 (1809, Server 2019), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.22631.7711 (23H2), 10.0.26100.9974 (24H2), 10.0.26200.9974 (25H2), 10.0.28000.3501 (26H1), 10.0.26300.9974 (26H2), 10.0.20348.5870 (Server 2022)
• Install the current cumulative update from Microsoft and verify the build number afterwards.

Workaround

Unknown.

Exploitation

• No public proof of concept or confirmed exploitation was found at the time of writing.
• The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as far as could be verified.
• NVD analysis was still pending at the time of writing.

Our recommendation

• Inventory Windows hosts and check whether the Client for NFS feature is installed (for example with Get-WindowsOptionalFeature).
• Apply the Microsoft security update for the affected builds listed above as soon as possible.
• If the NFS client is not needed, disable the feature until the update is applied.
• Re-check the Microsoft Security Update Guide and NVD for changes to the affected products or exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88249 msrc.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 20:56.