CVE-2026-78445 – Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability

CVE-2026-78445 is a critical use-after-free vulnerability in the Windows Services for NFS ONCRPC XDR Driver. An unauthorized remote attacker can exploit the flaw by sending a specially crafted, unauthenticated call to a Network File System (NFS) service, potentially achieving remote code execution. The vulnerability requires no privileges or user interaction and has low attack complexity.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: An attacker can target a vulnerable NFS service remotely over the network. Successful exploitation could compromise confidentiality, integrity, and availability, with all three rated High in the CVSS metrics. No authentication, privileges, or user interaction is required.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven, and the exploitation assessment is “Exploitation Less Likely.” No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified in the source information.

TECHNICAL SUMMARY: The vulnerability is caused by a use-after-free condition (CWE-416) in the Windows Services for NFS ONCRPC XDR Driver. A remote attacker can make an unauthenticated, specially crafted call to a Network File System service that triggers the flaw and leads to remote code execution. The attack vector is network-based, attack complexity is Low, privileges are not required, and no user interaction is necessary. Successful exploitation can have a High impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their listed Server Core installations. A remote, unauthenticated attacker can exploit the vulnerability through a specially crafted NFS service call.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution on affected Windows servers, creating the potential for serious compromise of sensitive information, system integrity, and service availability. For organizations running affected NFS services, a network-reachable weakness requiring no credentials or user action can create significant operational and security risk.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, and affected systems require a restart according to the affected-software information.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8. Its network attack vector, low attack complexity, and lack of authentication or user-interaction requirements make timely deployment important, even though exploitation is currently assessed as less likely and no exploitation is reported.