Microsoft disclosed a CVSS 9.8 use-after-free flaw in the Windows Services for NFS ONCRPC XDR Driver that lets an unauthorized attacker execute code over a network without credentials or user interaction.
What Is It
CVE-2026-78445 is a use-after-free vulnerability (CWE-416) in the ONCRPC XDR Driver component of Windows Services for NFS. Per Microsoft's description, the flaw "allows an unauthorized attacker to execute code over a network." Microsoft assigned it a CVSS 3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVE was published on 2026-09-08 and is currently listed by NVD as "Undergoing Analysis."
Why It Matters
Every exploitability dimension in the CVSS vector is at its worst value: network attack vector, low attack complexity, no privileges required, and no user interaction. That yields a maximum exploitability subscore of 3.9. Impact is equally severe; high confidentiality, integrity, and availability loss, for an impact subscore of 5.9.
The affected component is a kernel-mode driver handling ONCRPC/XDR parsing. Microsoft's AV:N/PR:N/UI:N rating implies the vulnerable code path is reachable across the network without authentication, which would suggest any host able to send NFS traffic to the server is in scope; no public technical analysis confirming the specific reachable code path is available at this time. Because the affected product set is server-only, exposure concentrates in file-serving infrastructure.
As of publication, this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), and the supplied source material contains no evidence of active exploitation in the wild.
What's Vulnerable
Microsoft lists the following x64-based Windows Server products as affected, with the first fixed build shown:
| Product | Affected below |
|---|---|
| Windows Server 2012 (incl. Server Core) | 6.2.9200.26349 |
| Windows Server 2012 R2 (incl. Server Core) | 6.3.9600.23397 |
| Windows Server 2016 (incl. Server Core) | 10.0.14393.9512 |
| Windows Server 2019 (incl. Server Core) | 10.0.17763.9245 |
| Windows Server 2022 | 10.0.20348.5622 |
| Windows Server 2025 (incl. Server Core) | 10.0.26100.33438 |
All listed ranges begin at the product's base build (e.g. 6.2.9200.0), meaning every unpatched build is affected.
Patch Status
Fixed builds exist for all affected products, as reflected in the version ranges above. Administrators should update to at least the corresponding fixed build for their Windows Server release. With no entry in the CISA KEV catalog, no KEV-mandated remediation deadline applies. Microsoft's update guide entry is the authoritative source for patch packages.
Sources
- Microsoft Security Response Center; CVE-2026-78445: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78445
- NVD, CVE-2026-78445: https://nvd.nist.gov/vuln/detail/CVE-2026-78445
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog