CVE-2026-70585 – Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability

CVE-2026-70585 is a critical use-after-free vulnerability in the Windows Services for NFS ONCRPC XDR Driver. An authorized attacker with low privileges could exploit the flaw locally to execute code. Successful exploitation requires winning a race condition, making the attack complexity high, but no user interaction is required.

CVSS SCORE: 7.

SEVERITY: Critical.

THREAT: The vulnerability can enable local remote code execution and has high potential impact to confidentiality, integrity, and availability. An attacker must already have low-level privileges and successfully win a race condition. Exploitation is assessed as more likely, although the vulnerability was not publicly disclosed or known to be exploited at publication.

EXPLOITS: There is no confirmed exploitation and the vulnerability is not publicly disclosed. Exploit code maturity is classified as Unproven. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-70585 is caused by a use-after-free weakness (CWE-416) in the Windows Services for NFS ONCRPC XDR Driver. An authorized attacker with low privileges can attempt to trigger the memory-safety condition locally. Successful exploitation requires the attacker to win a race condition, which accounts for the high attack complexity. If successful, the flaw allows code execution and can have high confidentiality, integrity, and availability impact. The attack scope remains unchanged and no user interaction is needed.

EXPLOITABILITY: Affected products include Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their listed Server Core installations. Exploitation requires local access, low privileges, and successfully winning a race condition. No user interaction is required.

BUSINESS IMPACT: Successful exploitation could allow an attacker who already has limited access to execute code on an affected server. This could lead to compromise of sensitive information, unauthorized changes, and disruption of server availability, creating significant operational and security risk.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, and affected systems require a restart after applying the listed updates.

URGENCY: This vulnerability carries a Critical severity rating and can result in code execution with high confidentiality, integrity, and availability impact. Organizations should prioritize deployment of the applicable security update across affected Windows Server systems, particularly systems running Services for NFS.