CVE-2026-71334: Windows NFS Portmapper Privilege Escalation

CVE-2026-71334 Overview

CVE-2026-71334 is a heap-based buffer overflow [CWE-122] in the Windows Network File System (NFS) Portmapper component. An authorized local attacker can trigger the overflow to elevate privileges on an affected Windows host. Microsoft published the advisory on 2026-09-08.

The flaw requires local access and low privileges, with no user interaction. Successful exploitation yields high impact on confidentiality, integrity, and availability. The Portmapper service maps Remote Procedure Call (RPC) program numbers to network ports, making it a persistent attack surface on hosts running the NFS role.

Critical Impact
A local attacker with standard user privileges can corrupt heap memory in the NFS Portmapper service to achieve privilege escalation to SYSTEM.

Affected Products

Microsoft Windows with the NFS Server role enabled
Windows Server editions exposing the NFS Portmapper service
Windows systems running the RPC Portmapper for NFS

Discovery Timeline

2026-09-08 - CVE-2026-71334 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-71334

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in the Windows NFS Portmapper. Portmapper handles Open Network Computing (ONC) RPC requests that register and locate RPC services, including NFS. Improper bounds checking on attacker-influenced input allows data to be written beyond the allocated heap buffer.

Because the Portmapper service runs with elevated privileges, memory corruption within its process can be leveraged to execute code in that security context. The result is local privilege escalation from a standard authorized user to a higher-privileged account.

Root Cause

The root cause is insufficient validation of input sizes when processing Portmapper requests. A length or field value from a crafted RPC message is trusted without proper boundary enforcement, allowing writes past the end of a heap allocation. This maps to [CWE-122] Heap-based Buffer Overflow.

Attack Vector

Exploitation requires local access and an authenticated session on the target host. The attacker sends crafted Portmapper RPC requests to the local NFS service to trigger the overflow. No user interaction is required, and the attack complexity is low.

No public proof-of-concept exploit or in-the-wild exploitation has been documented at publication time. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.246%.

See the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2026-71334

Indicators of Compromise

Unexpected crashes or restarts of the NFS Portmapper service (portmap.exe / associated RPC service) recorded in the Windows Event Log
Creation of new privileged accounts or unexpected SYSTEM-context processes spawned from RPC service hosts
Anomalous local RPC traffic directed at Portmapper endpoints on hosts with the NFS Server role

Detection Strategies

Monitor process integrity and child process creation for the NFS Portmapper service, flagging any non-standard child processes.
Alert on Windows Error Reporting (WER) crash dumps referencing the Portmapper binary or heap corruption exceptions.
Correlate local authentication events with subsequent RPC service crashes on NFS-enabled servers.

Monitoring Recommendations

Enable and forward Windows Security, System, and Application logs from all servers running the NFS role to a centralized analytics platform.
Track privilege escalation telemetry, including token manipulation and SYSTEM-context process launches originating from standard user sessions.
Baseline normal Portmapper activity and alert on deviations in request rate, source, or payload size.

How to Mitigate CVE-2026-71334

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all Windows hosts with the NFS role.
Inventory systems with the NFS Server feature enabled and prioritize patching on multi-tenant or shared-access hosts.
Restrict interactive and remote-desktop access on NFS servers to trusted administrative accounts only.

Patch Information

Microsoft has released a security update addressing CVE-2026-71334. Refer to the Microsoft Security Update Guide for the specific KB article, affected builds, and installation instructions for each supported Windows version.

Workarounds

Disable the NFS Server role on hosts that do not require it using Disable-WindowsOptionalFeature or Server Manager.
Stop and disable the Portmapper and NFS services on unaffected roles until patches are applied.
Enforce least-privilege on interactive logon rights to reduce the pool of accounts able to reach the local attack surface.

bash

# Configuration example: disable the NFS Server role on Windows Server (PowerShell)
Uninstall-WindowsFeature -Name FS-NFS-Service

# Or stop and disable the Portmapper service if the role must remain installed
Stop-Service -Name portmap -Force
Set-Service -Name portmap -StartupType Disabled