External risk intelligence

Windows Services for NFS Use After Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-78445

This vulnerability affects Windows Services for NFS (Network File System), a protocol typically deployed in internal, trusted network environments for file sharing. While it is network-accessible, it is rarely exposed directly to the public internet in standard deployment configurations, as it is generally intended for local network or enterprise infrastructure use.

Use After Free

Microsoft Windows Server 2012

r2before 10.0.14393.9512before 10.0.17763.9245before 10.0.20348.5622before 10.0.26100.33438

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Windows Services for NFS, which could allow an unauthorized attacker to execute code over a network. This type of flaw, known as a "use after free" error, is generally severe. The primary concern at this time is to confirm if this specific service is active and exposed within our environment, as its typical deployment is within trusted internal networks.

A network code execution flaw exists.
Assess internal exposure of this service.
Confirm relevance and confirm our exposure.

Attack Path

How an attacker could exploit the issue

A remote attacker could exploit a use-after-free vulnerability in the Windows Services for NFS ONCRPC XDR Driver to execute arbitrary code over a network. This attack does not require any special privileges or user interaction, potentially allowing an unauthorized individual to gain control of the affected system.

No privileges or user interaction needed.
Exploited via the network.
Enables unauthorized code execution.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in the Windows Services for NFS ONCRPC XDR Driver could allow an unauthenticated attacker to execute code over a network. This could affect the availability and integrity of services relying on this driver when exposed to untrusted networks.

System availability and integrity.
Remote code execution over a network.
Unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Windows Services for NFS allows remote code execution, making it imperative for infrastructure and security teams to act swiftly. The first step involves identifying all instances of the affected Windows Services for NFS, determining their network exposure and business criticality, and locating the accountable system owner for remediation planning. Coordination between platform, network, and security teams will be crucial to mitigate this risk effectively.

Infrastructure and security teams own remediation.
Verify NFS services, exposure, and business criticality.
Plan remediation based on identified risk and ownership.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Windows Services for NFS?

Windows Services for Network File System (NFS) is a component that enables Windows servers to act as file servers for Unix-based systems. It allows computers running different operating systems to share files seamlessly across a network by providing a cross-platform file sharing protocol, which is essential for environments that integrate Windows and Linux or Unix infrastructures.

What does CVE-2026-78445 mean by use after free?

This vulnerability is classified as CWE-416, or 'Use After Free.' It happens when software continues to use a pointer to a memory location after that memory has been freed or cleared. In this specific case, an attacker can manipulate this flaw in the ONCRPC XDR Driver to overwrite that freed memory with their own data, which may allow them to execute unauthorized code on the system.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specially crafted network requests to the Windows Services for NFS component. The vulnerability does not require the attacker to have existing user privileges or for a local user to interact with the system; however, it only occurs if the system is actively running the NFS service and processing ONCRPC XDR traffic.

Is my system at risk if it is not on the internet?

According to Halo Surface Signal, this service is typically used within internal, trusted networks for enterprise file sharing rather than being exposed to the public internet. While the vulnerability is technically network-reachable, its relevance depends on whether your NFS service is accessible to untrusted parties or sits on a restricted segment. You should check if your configuration keeps this traffic isolated from unauthorized network zones.

What should I do first to address CVE-2026-78445?

Your immediate priority is to conduct an audit to identify all systems where Windows Services for NFS is enabled. Once you have a list of these assets, verify their current network exposure and determine which systems handle sensitive data. Coordinate with your infrastructure and security teams to prioritize these assets for maintenance while you monitor vendor updates.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78445

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.