CVE-2026-118138 · Infrastructure
NO FIX YET
Windows Client for NFS has a race condition in how it handles a shared resource, so a local attacker who is already authorized can elevate their privileges. The sources rate it high (CVSS 7.8) and do not report active exploitation.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems running Windows with the Client for NFS feature enabled are the ones to look at, since the flaw is in that component. The sources do not say which Windows builds are affected, and the attacker needs an authorized local account, so machines without NFS client use or without local user access are lower risk. unknown beyond that.
Not affected if nfs-client-not-enabled
Who cares nfs, windows
No fix yet, per the sources.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Client for NFS allows an authorized attacker to elevate privileges locally.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.