{"id":"CVE-2026-118138","kind":"vulnerability","aliases":["CVE-2026-118138"],"related":[],"title":"Windows Client for NFS: race condition lets a local user gain privileges","description":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Client for NFS allows an authorized attacker to elevate privileges locally.","summary":"Windows Client for NFS has a race condition in how it handles a shared resource, so a local attacker who is already authorized can elevate their privileges. The sources rate it high (CVSS 7.8) and do not report active exploitation.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","nfs","windows"],"not_affected_if":["nfs-client-not-enabled"],"how_to_check":"- Check whether the Windows Client for NFS feature is installed and enabled on the machine (unknown from the sources for exact commands)\n- Compare the Windows build against Microsoft's security update guide for this CVE (unknown from the sources)","fix":null,"status":"open","published_at":"2026-11-10T19:19:32+00:00","first_seen_at":"2026-11-10T19:24:48+00:00","triaged_at":"2026-11-10T19:40:45+00:00","updated_at":"2026-11-10T19:40:45+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:40:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Client for NFS: race condition lets a local user gain privileges","impact":"high","summary":"Windows Client for NFS has a race condition in how it handles a shared resource, so a local attacker who is already authorized can elevate their privileges. The sources rate it high (CVSS 7.8) and do not report active exploitation.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","nfs"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains higher privileges on the Windows machine","analyst_note":"Find the affected Windows builds and Microsoft's fixed update for CVE-2026-118138 in the Microsoft Security Update Guide; the sources give only the NVD description.","how_to_check":"- Check whether the Windows Client for NFS feature is installed and enabled on the machine (unknown from the sources for exact commands)\n- Compare the Windows build against Microsoft's security update guide for this CVE (unknown from the sources)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["nfs-client-not-enabled"],"who_is_affected":"Systems running Windows with the Client for NFS feature enabled are the ones to look at, since the flaw is in that component. The sources do not say which Windows builds are affected, and the attacker needs an authorized local account, so machines without NFS client use or without local user access are lower risk. unknown beyond that.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000725,"input_tokens":4502,"output_tokens":550,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected Windows builds and Microsoft's fixed update for CVE-2026-118138 in the Microsoft Security Update Guide; the sources give only the NVD description.","search":"'-118138':15A,18A '-2026':14A,17A '7.8':55B 'activ':60B 'allow':77C 'alreadi':43B 'attack':40B,80C 'author':44B,79C 'client':2A,23B,74C 'concurr':62C 'condit':6A,29B,71C 'cve':13A,16A 'cvss':54B 'elev':46B,82C 'execut':63C 'exploit':61B 'gain':11A 'handl':33B 'high':53B 'improp':68C 'infrastructur':19B 'let':7A 'local':9A,39B,84C 'nfs':4A,20B,25B,76C 'privileg':12A,48B,83C 'race':5A,28B,70C 'rate':51B 'report':59B 'resourc':36B,66C 'share':35B,65C 'sourc':50B 'synchron':69C 'use':64C 'user':10A 'window':1A,21B,22B,73C","nicknames":[],"mitigations":[],"who_affected":"Systems running Windows with the Client for NFS feature enabled are the ones to look at, since the flaw is in that component. The sources do not say which Windows builds are affected, and the attacker needs an authorized local account, so machines without NFS client use or without local user access are lower risk. unknown beyond that.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","nfs","windows"],"campaign_type":null,"search_a":"'-118138':15A,18A '-2026':14A,17A 'client':2A 'condit':6A 'cve':13A,16A 'gain':11A 'let':7A 'local':9A 'nfs':4A 'privileg':12A 'race':5A 'user':10A 'window':1A","search_b":"'7.8':55B 'activ':60B 'alreadi':43B 'attack':40B 'author':44B 'client':23B 'condit':29B 'cvss':54B 'elev':46B 'exploit':61B 'handl':33B 'high':53B 'infrastructur':19B 'local':39B 'nfs':20B,25B 'privileg':48B 'race':28B 'rate':51B 'report':59B 'resourc':36B 'share':35B 'sourc':50B 'window':21B,22B","search_c":"'allow':77C 'attack':80C 'author':79C 'client':74C 'concurr':62C 'condit':71C 'elev':82C 'execut':63C 'improp':68C 'local':84C 'nfs':76C 'privileg':83C 'race':70C 'resourc':66C 'share':65C 'synchron':69C 'use':64C 'window':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118138","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118138","severity":null,"published_at":"2026-11-10T19:19:32+00:00","modified_at":"2026-11-10T19:19:32+00:00","first_seen_at":"2026-11-10T19:24:48+00:00","fetched_at":"2026-11-10T19:24:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}