Description

Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-08T18:20:42.263Z",
  "pubdate": "2026-09-08T18:20:42.263Z",
  "executiveSummary": "This vulnerability is identified as a Use-After-Free (UAF) memory corruption flaw residing within the Windows Services for NFS (Network File System) ONCRPC (Open Network Computing Remote Procedure Call) XDR (External Data Representation) driver.\nThe vulnerability allows an unauthenticated, remote attacker to execute arbitrary code with elevated system privileges by sending specially crafted packets to the affected NFS service.\nThe flaw impacts the integrity, availability, and confidentiality of the host operating system. Successful exploitation necessitates the ability to trigger a memory allocation/deallocation sequence that leaves a dangling pointer accessible for manipulation.\nAs this service handles network requests, the exposure is significant for any infrastructure utilizing Windows Server implementations of NFS. Because the vulnerability exists within a low-level system driver, malicious code execution typically occurs at the kernel level, granting the attacker total control over the compromised system.\nThe risk is critical due to the lack of required authentication and the potential for wormable exploitation scenarios where an attacker can propagate the attack across a network segment without direct user interaction.",
  "technicalDetails": "The vulnerability originates in the ONCRPC XDR decoding logic within the Windows NFS driver. Use-after-free occurs when the driver fails to properly manage the lifecycle of a memory object during the processing of malformed or specifically sequenced XDR encoded requests.\nIn the context of ONCRPC, the XDR implementation is responsible for marshaling and unmarshaling data structures. The flaw manifests when the driver allocates a memory buffer to hold a request, begins processing the data, but triggers a deallocation prematurely due to an error condition or specific state transition within the state machine. Crucially, a reference to this deallocated memory buffer is preserved in a data structure (the dangling pointer).\nAn attacker leverages this by sending a crafted RPC request that forces the driver to free the memory associated with an RPC object while maintaining a pointer to that address. By subsequently sending further malicious packets, the attacker triggers a heap-spraying or re-allocation operation to place controlled data into the freed memory block. When the driver eventually attempts to access the original pointer to continue processing or complete the RPC call, it interacts with the attacker-controlled data instead of the legitimate object.\nThis interaction allows the attacker to hijack the control flow of the kernel execution thread. By carefully crafting the attacker-controlled data, the attacker can redirect execution to arbitrary code (e.g., a ROP chain or shellcode) injected into kernel memory. Because this occurs at the driver level, the execution occurs within the context of the System account.\nThe attack flow follows these steps: 1) The attacker initiates an ONCRPC connection to the target Windows NFS service. 2) The attacker transmits a series of malicious packets designed to induce the vulnerable driver into a state where it deallocates an XDR object prematurely. 3) The attacker utilizes a heap-spraying technique via further RPC requests to populate the freed heap memory with a malicious payload. 4) The attacker triggers the vulnerable code path that references the dangling pointer, causing the processor to branch into the malicious payload. 5) Arbitrary code executes with kernel-level privileges, resulting in full system compromise."
}