CVE-2026-78445: Windows NFS ONCRPC XDR Use After Free

CVE-2026-78445 Overview

CVE-2026-78445 is a use-after-free vulnerability in the Windows Services for Network File System (NFS) Open Network Computing Remote Procedure Call (ONCRPC) External Data Representation (XDR) driver. The flaw allows an unauthenticated attacker to execute code remotely over a network. The vulnerability is tracked under CWE-416: Use After Free and affects Windows systems with the NFS role enabled. Microsoft published the advisory on the Microsoft Security Response Center portal.

Critical Impact
Unauthenticated remote attackers can execute arbitrary code in the context of the vulnerable NFS driver, leading to full system compromise without user interaction.

Affected Products

Microsoft Windows with the Services for NFS role installed
Windows Server deployments running the ONCRPC XDR driver
Windows systems exposing NFS ONCRPC endpoints over the network

Discovery Timeline

2026-09-08 - CVE-2026-78445 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-78445

Vulnerability Analysis

The vulnerability resides in the Windows Services for NFS ONCRPC XDR driver, which parses external data representation streams received from remote clients. A use-after-free condition [CWE-416] occurs when the driver references a memory object after it has been freed. Attackers can trigger the flaw by sending crafted ONCRPC messages to an exposed NFS endpoint. Successful exploitation leads to memory corruption and control of execution flow inside the kernel driver.

Because the attack vector is network-based and requires no privileges or user interaction, the vulnerability is suitable for wormable exploitation across Windows servers exposing NFS. Compromise of the driver grants attackers execution in a privileged context, providing a direct path to full host takeover.

Root Cause

The root cause is improper lifetime management of a heap object during ONCRPC XDR message decoding. The driver dereferences a pointer to a previously released allocation, allowing an attacker to influence the contents of the reused memory region. This class of flaw commonly arises from race conditions, error-handling paths that free objects without clearing references, or reference-count mismanagement.

Attack Vector

An unauthenticated attacker sends specially crafted ONCRPC traffic to a Windows host with the NFS service enabled. The malformed XDR payload triggers the use-after-free during message parsing. Because processing occurs before authentication, no credentials are required. See the Microsoft Security Response Center advisory for vendor-supplied technical details.

// No verified proof-of-concept code is publicly available.
// Refer to the Microsoft MSRC advisory for authoritative technical details.

Detection Methods for CVE-2026-78445

Indicators of Compromise

Unexpected crashes or bugchecks referencing the NFS ONCRPC XDR driver in Windows Event Logs
Anomalous inbound traffic to TCP/UDP port 111 (portmapper) or port 2049 (NFS) from untrusted networks
Unusual child processes spawned by NFS service components (nfssvc.exe, nfsclnt.exe)
New kernel-mode threads or loaded drivers following spikes in ONCRPC traffic

Detection Strategies

Monitor kernel crash dumps and Windows Error Reporting entries for faults in ONCRPC XDR driver modules
Deploy network detection rules for malformed or oversized ONCRPC and NFS RPC requests
Correlate NFS service anomalies with subsequent privilege escalation or lateral movement telemetry

Monitoring Recommendations

Enable verbose logging for the Services for NFS role and forward events to a centralized log platform
Baseline legitimate NFS client sources and alert on connections from unexpected network segments
Track driver load events and integrity failures on Windows Servers running the NFS role

How to Mitigate CVE-2026-78445

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-78445 as soon as possible
Inventory all Windows hosts with the Services for NFS role enabled and prioritize internet-exposed systems
Restrict inbound access to NFS ports (111, 2049) at the network perimeter and internal segmentation boundaries

Patch Information

Microsoft has published guidance and updates for CVE-2026-78445 through the Microsoft Security Response Center. Administrators should consult the official MSRC advisory for affected build numbers and the corresponding KB articles. Apply patches through Windows Update, WSUS, or your patch management platform.

Workarounds

Disable the Services for NFS role on hosts that do not require NFS functionality
Block ONCRPC and NFS traffic (ports 111 and 2049) from untrusted networks using host and perimeter firewalls
Enforce IPsec or VPN authentication for legitimate NFS clients to prevent unauthenticated network reach

bash

# Windows PowerShell: verify and disable the Services for NFS role if not required
Get-WindowsFeature -Name FS-NFS-Service
Uninstall-WindowsFeature -Name FS-NFS-Service -Restart

# Restrict inbound NFS traffic to trusted subnets only
New-NetFirewallRule -DisplayName "Block NFS ONCRPC External" -Direction Inbound -Protocol TCP -LocalPort 111,2049 -RemoteAddress Any -Action Block