{"id":"CVE-2026-118141","kind":"vulnerability","aliases":["CVE-2026-118141"],"related":[],"title":"Windows Client for NFS: stack overflow lets a network attacker run code","description":"Stack-based buffer overflow in Windows Client for NFS allows an unauthorized attacker to execute code over a network.","summary":"Windows Client for NFS has a stack-based buffer overflow that a remote, unauthenticated attacker can trigger over the network. Successful exploitation lets the attacker execute code on the affected Windows machine.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10/11 and Windows Server (Client for NFS)","fixed":["10.0.14393.9688","10.0.17763.9487","10.0.19044.7846","10.0.19045.7846","10.0.22631.7711","10.0.26100.9974","10.0.26200.9974","10.0.28000.3501","10.0.26300.9974","10.0.20348.5870","10.0.26100.33822"],"affected":"< fixed build per release","ecosystem":"vendor"}],"ecosystems":[],"tags":["client-for-nfs","infrastructure","nfs","windows","windows-10","windows-11","windows-server"],"not_affected_if":["client-for-nfs-not-installed"],"how_to_check":"Run winver or [System.Environment]::OSVersion and compare the build (e.g. 10.0.22631.x) with the fixed build for your release. Then check whether the Client for NFS feature is installed: Get-WindowsOptionalFeature -Online | Where FeatureName -like '*NFS*' (or DISM /online /Get-Features | findstr NFS). If it is not installed, the vulnerable component is not present (default state not confirmed from a source). Also check Server for NFS separately; only Client for NFS is named in this CVE.","fix":"Install the November 2026 Windows cumulative update: Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H1 10.0.28000.3501; 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822.","status":"open","published_at":"2026-11-10T19:19:33+00:00","first_seen_at":"2026-11-10T19:24:49+00:00","triaged_at":"2026-11-10T19:30:18+00:00","updated_at":"2026-11-10T23:24:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:30:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Client for NFS: stack overflow lets a network attacker run code","impact":"high","summary":"Windows Client for NFS has a stack-based buffer overflow that a remote, unauthenticated attacker can trigger over the network. Successful exploitation lets the attacker execute code on the affected Windows machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","nfs"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the Windows client over the network","analyst_note":"Confirm affected Windows builds, whether Client for NFS is enabled by default, and the Microsoft fixed build from the MSRC advisory for CVE-2026-118141.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines that have the Client for NFS feature enabled and mount NFS shares are the systems to look at. The sources do not say which Windows builds are affected or whether the feature is on by default, so unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000666,"input_tokens":4494,"output_tokens":433,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Windows builds, whether Client for NFS is enabled by default, and the Microsoft fixed build from the MSRC advisory for CVE-2026-118141.","search":"'-10':35B '-11':37B '-118141':15A,18A '-2026':14A,17A '10/11':20A 'affect':71B 'allow':84C 'and':21A 'attack':10A,56B,66B,87C 'base':49B,76C 'buffer':50B,77C 'client':2A,24A,28B,42B,81C 'client-for-nf':27B 'code':12A,68B,90C 'cve':13A,16A 'execut':67B,89C 'exploit':63B 'for':25A 'infrastructur':31B 'let':7A,64B 'machin':73B 'network':9A,61B,93C 'nfs':4A,26A,30B,32B,44B,83C 'overflow':6A,51B,78C 'remot':54B 'run':11A 'server':23A,40B 'stack':5A,48B,75C 'stack-bas':47B,74C 'success':62B 'trigger':58B 'unauthent':55B 'unauthor':86C 'window':1A,33B,34B,36B,39B,41B,72B,80C 'windows':19A,22A 'windows-serv':38B","nicknames":[],"mitigations":[],"who_affected":"Windows 10, Windows 11 and Windows Server 2016 to 2025 machines that have the Client for NFS feature enabled and mount NFS shares, such as mixed Windows/Linux file-sharing setups and build or data hosts. The CVSS vector says user interaction is required, so exposure likely means a user or service connecting to an attacker-controlled NFS server; Microsoft's exact trigger was not read. Machines without Client for NFS can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1011andwindowsserverclientfornfs","windows1011andwindowsserverclientfornfs"],"ptokens":["10","11","and","client","for","nfs","server","windows"],"labels":["clientfornfs","high","infrastructure","nfs","windows","windows10","windows11","windowsserver"],"campaign_type":null,"search_a":"'-118141':15A,18A '-2026':14A,17A '10/11':20A 'and':21A 'attack':10A 'client':2A,24A 'code':12A 'cve':13A,16A 'for':25A 'let':7A 'network':9A 'nfs':4A,26A 'overflow':6A 'run':11A 'server':23A 'stack':5A 'window':1A 'windows':19A,22A","search_b":"'-10':35B '-11':37B 'affect':71B 'attack':56B,66B 'base':49B 'buffer':50B 'client':28B,42B 'client-for-nf':27B 'code':68B 'execut':67B 'exploit':63B 'infrastructur':31B 'let':64B 'machin':73B 'network':61B 'nfs':30B,32B,44B 'overflow':51B 'remot':54B 'server':40B 'stack':48B 'stack-bas':47B 'success':62B 'trigger':58B 'unauthent':55B 'window':33B,34B,36B,39B,41B,72B 'windows-serv':38B","search_c":"'allow':84C 'attack':87C 'base':76C 'buffer':77C 'client':81C 'code':90C 'execut':89C 'network':93C 'nfs':83C 'overflow':78C 'stack':75C 'stack-bas':74C 'unauthor':86C 'window':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118141","severity":null,"published_at":"2026-11-10T19:19:33+00:00","modified_at":"2026-11-10T19:19:34+00:00","first_seen_at":"2026-11-10T19:24:49+00:00","fetched_at":"2026-11-10T19:24:49+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118141:3163","url":"https://nvd.nist.gov/vuln/detail/cve-2026-118141","severity":null,"published_at":"2026-11-10T23:24:35+00:00","modified_at":"2026-11-10T23:24:35+00:00","first_seen_at":"2026-11-10T23:24:35+00:00","fetched_at":"2026-11-10T23:24:35+00:00","note":"Build numbers from Microsoft CNA data as shown on NVD; MSRC page returned empty so nothing marked verified. No exploitation or PoC found (OffSeq, Nov 10). X not checked. Default-enabled state of Client for NFS not confirmed from a source.","cites":["https://nvd.nist.gov/vuln/detail/cve-2026-118141","https://radar.offseq.com/threat/cve-2026-118141-cwe-121-stack-based-buffer-overflow-in-microsoft-windows-10-version-1607-e0bfc73b1b2d0e7e"]}],"documents":[{"id":120151,"url":"https://nvd.nist.gov/vuln/detail/cve-2026-118141","title":"NVD CVE-2026-118141 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":120152,"url":"https://radar.offseq.com/threat/cve-2026-118141-cwe-121-stack-based-buffer-overflow-in-microsoft-windows-10-version-1607-e0bfc73b1b2d0e7e","title":"OffSeq Threat Radar CVE-2026-118141","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}