CVE-2026-73024: Windows NFS ONCRPC XDR Driver Vulnerability

CVE-2026-73024 Overview

CVE-2026-73024 is a heap-based buffer overflow [CWE-122] in the Windows Services for Network File System (NFS) Open Network Computing Remote Procedure Call (ONCRPC) External Data Representation (XDR) Driver. An authorized local attacker can trigger the overflow to elevate privileges on the affected host. The flaw resides in a kernel-mode driver, so successful exploitation grants attackers elevated execution context suitable for further compromise. Microsoft published the advisory in the Microsoft Security Response Center (MSRC) update guide.

Critical Impact
A local, authenticated attacker can corrupt kernel heap memory in the NFS ONCRPC XDR driver to escalate to elevated privileges, resulting in full compromise of confidentiality, integrity, and availability on the affected system.

Affected Products

Microsoft Windows with the Services for NFS role or feature enabled
Windows Server editions shipping the ONCRPC XDR driver
Windows client editions that install the NFS client components

Discovery Timeline

2026-09-08 - CVE-2026-73024 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in the NVD database

Technical Details for CVE-2026-73024

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow inside the ONCRPC XDR driver that ships with Windows Services for NFS. XDR is the serialization format used by ONCRPC to marshal arguments across NFS boundaries. The driver processes XDR-encoded structures in kernel-mode memory allocated from the pool. Insufficient validation of length fields before copying attacker-controlled data into a fixed-size heap buffer leads to out-of-bounds writes. Because the code runs in kernel context, corrupted pool metadata or adjacent kernel objects can be leveraged to hijack execution and gain SYSTEM privileges.

Root Cause

The root cause is missing or incorrect bounds checking during XDR deserialization inside the ONCRPC driver. The driver trusts a caller-supplied length or count value and writes beyond the allocated heap buffer. This class of defect maps to [CWE-122], heap-based buffer overflow, and typically stems from arithmetic on untrusted length fields prior to a memcpy-style copy.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An authenticated attacker crafts a malformed ONCRPC request or IOCTL that reaches the vulnerable XDR parsing path in the kernel driver. Precise heap grooming allows the attacker to overwrite adjacent pool objects or function pointers. Successful exploitation yields elevated privileges on the local machine. Refer to the Microsoft Security Update Guide for exploitation details tracked by the vendor.

No public proof-of-concept code has been published. Technical exploitation details are not disclosed in the vendor advisory beyond the class of vulnerability.

Detection Methods for CVE-2026-73024

Indicators of Compromise

Unexpected kernel pool corruption events, bugchecks, or BAD_POOL_HEADER and KERNEL_MODE_HEAP_CORRUPTION stop codes referencing nfsrdr.sys, oncrpc.sys, or msnfsflt.sys.
Local processes running as low-privileged users spawning child processes as NT AUTHORITY\SYSTEM shortly after interacting with NFS components.
Anomalous IOCTL traffic to NFS-related device objects from non-administrative user sessions.

Detection Strategies

Enable Windows kernel crash dump collection and review dumps for faults inside ONCRPC XDR parsing routines.
Hunt for suspicious child-process creation chains where an NFS-related service or driver interaction precedes a token elevation to SYSTEM.
Correlate Windows Event Log entries for service crashes and driver faults with EDR process telemetry from the same session.

Monitoring Recommendations

Monitor endpoints with the Services for NFS role enabled and inventory hosts exposing the ONCRPC XDR driver.
Alert on new local privilege escalations from interactive or remote-interactive sessions on affected hosts.
Track patch compliance for the Microsoft security update that addresses CVE-2026-73024.

How to Mitigate CVE-2026-73024

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Windows systems.
Inventory servers and clients with the Services for NFS role or NFS client feature installed and prioritize patching those systems.
Restrict local logon rights on hosts running NFS components to reduce the pool of accounts that can exploit the flaw.

Patch Information

Microsoft has released a security update addressing CVE-2026-73024. Consult the Microsoft Security Update Guide for the specific KB article, affected build numbers, and cumulative update details applicable to each Windows version.

Workarounds

Disable the Windows Services for NFS role or feature on systems that do not require NFS interoperability until the patch is applied.
Remove the NFS client optional feature from Windows client editions where it is not needed.
Enforce least privilege and application control policies to limit which local accounts can invoke NFS driver code paths.

bash

# Disable the Server for NFS and Client for NFS features on Windows Server
# Run from an elevated PowerShell session
Disable-WindowsOptionalFeature -Online -FeatureName ServicesForNFS-ServerAndClient -NoRestart
Disable-WindowsOptionalFeature -Online -FeatureName ClientForNFS-Infrastructure -NoRestart
Disable-WindowsOptionalFeature -Online -FeatureName ServerForNFS-Infrastructure -NoRestart

# Verify the features are disabled
Get-WindowsOptionalFeature -Online -FeatureName ServicesForNFS-ServerAndClient