CVE-2026-70585 Overview
CVE-2026-70585 is a use-after-free vulnerability [CWE-416] in the Windows Services for Network File System (NFS) Open Network Computing Remote Procedure Call (ONCRPC) External Data Representation (XDR) Driver. The flaw allows an authorized local attacker to execute code on affected Windows systems. Microsoft published the advisory through the Microsoft Security Response Center (MSRC).
Exploitation requires local access and low privileges but no user interaction. Successful exploitation can compromise confidentiality, integrity, and availability of the target host.
Critical Impact
Successful exploitation grants local code execution in the context of a kernel-mode NFS driver, enabling potential privilege escalation on Windows systems with NFS services enabled.
Affected Products
- Microsoft Windows with Services for NFS enabled
- Windows ONCRPC XDR Driver component
- Refer to the Microsoft Security Update Guide CVE-2026-70585 for the definitive list of affected builds
Discovery Timeline
- 2026-09-08 - CVE-2026-70585 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-70585
Vulnerability Analysis
The vulnerability resides in the ONCRPC XDR Driver that supports Windows Services for NFS. XDR is the serialization format used by ONCRPC to encode arguments transmitted between NFS clients and servers. The driver mishandles the lifetime of an allocated object, referencing memory after it has been freed.
An authorized local attacker can trigger the freed allocation and then force the driver to dereference the stale pointer. Because the affected code path runs in kernel context, successful exploitation can lead to arbitrary code execution at elevated privilege.
The attack complexity is rated high, indicating that reliable exploitation depends on winning a race or shaping kernel memory in a specific way. However, the impact across confidentiality, integrity, and availability is high once exploitation succeeds.
Root Cause
The root cause is a use-after-free [CWE-416] in the ONCRPC XDR parsing or decoding logic within the NFS driver stack. The driver retains and reuses a pointer to an object whose backing memory has already been released. When the object is subsequently accessed, the driver operates on attacker-influenced data.
Attack Vector
Exploitation is local. The attacker must already be authenticated on the target Windows host and must be able to invoke code paths that reach the ONCRPC XDR Driver. No user interaction is required. See the Microsoft Security Update Guide CVE-2026-70585 for vendor technical details.
Detection Methods for CVE-2026-70585
Indicators of Compromise
- Unexpected kernel crashes or bug checks referencing the NFS ONCRPC XDR Driver
- Local processes issuing unusual NFS or ONCRPC IOCTLs from non-administrative user contexts
- New or unexpected privileged processes spawned shortly after NFS driver activity
Detection Strategies
- Monitor Windows kernel crash telemetry and Windows Error Reporting (WER) entries tied to NFS driver modules
- Correlate local user activity with NFS client or server API invocations to identify unauthorized interaction with the driver
- Alert on process integrity level transitions from Medium to System that follow NFS-related driver calls
Monitoring Recommendations
- Enable EDR telemetry for kernel driver loads, IOCTL activity, and process token changes on hosts with Services for NFS installed
- Forward Windows System, Security, and NFS Server event logs to a centralized data lake for retrospective hunting
- Track patch state of the ONCRPC XDR Driver across the fleet and alert on hosts running unpatched builds
How to Mitigate CVE-2026-70585
Immediate Actions Required
- Apply the Microsoft security update for CVE-2026-70585 as documented in the Microsoft Security Update Guide
- Inventory Windows hosts with the Services for NFS role or client installed and prioritize them for patching
- Restrict local logon rights on servers that expose NFS functionality to reduce the population of potential attackers
Patch Information
Microsoft has issued an update through the Security Update Guide. Administrators should consult the Microsoft Security Update Guide CVE-2026-70585 entry for the specific KB articles, affected builds, and cumulative update packages that address the use-after-free in the ONCRPC XDR Driver.
Workarounds
- Disable Windows Services for NFS on hosts that do not require NFS functionality until the patch is deployed
- Remove the Client for NFS and Server for NFS Windows features on non-NFS workloads via Server Manager or PowerShell
- Enforce least-privilege on interactive and remote-interactive logon groups to limit local attacker access
# Remove Windows Services for NFS features where not required (run in elevated PowerShell)
Disable-WindowsOptionalFeature -Online -FeatureName ServicesForNFS-ClientOnly -NoRestart
Disable-WindowsOptionalFeature -Online -FeatureName ClientForNFS-Infrastructure -NoRestart
Uninstall-WindowsFeature -Name FS-NFS-Service -IncludeManagementTools
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.