{"id":"CVE-2026-122165","kind":"vulnerability","aliases":["CVE-2026-122165"],"related":[],"title":"Windows Client for NFS: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Client for NFS lets an attacker who already has an account on the machine raise their privileges. The sources do not describe the exact trigger or the affected Windows builds.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10/11 and Windows Server (Client for NFS)","fixed":["Nov 2026 update"],"affected":"< fixed build per edition","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","nfs","windows"],"not_affected_if":["nfs-client-not-installed","no-local-untrusted-users"],"how_to_check":"- Run winver or [System.Environment]::OSVersion and compare the build (major.UBR) with the fixed builds in the fix field; lower means vulnerable.\n- Check whether Client for NFS is installed: PowerShell Get-WindowsOptionalFeature -Online -FeatureName ServicesForNFS-ClientOnly (Server: Get-WindowsFeature NFS-Client). Microsoft does not state that the feature must be enabled for the flaw to be reachable; treat unpatched as exposed if in doubt.","fix":"Install the November 2026 Windows cumulative update. Fixed builds: Win10 1607/Server 2016 10.0.14393.9688; Win10 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; Win11 25H2 10.0.26200.9974; Win11 26H1 10.0.28000.3501; Win11 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. KB numbers: unknown from sources, see the MSRC entry.","status":"open","published_at":"2026-11-10T19:20:33+00:00","first_seen_at":"2026-11-10T19:25:10+00:00","triaged_at":"2026-11-10T19:38:59+00:00","updated_at":"2026-11-10T21:43:04+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-10T19:38:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Client for NFS: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Client for NFS lets an attacker who already has an account on the machine raise their privileges. The sources do not describe the exact trigger or the affected Windows builds.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","nfs","local-privilege-escalation"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-122165 to get affected Windows builds and the patch KB.","how_to_check":"- Check whether the Windows Client for NFS feature is installed and enabled (Settings > Optional features or Turn Windows features on or off, 'Services for NFS').\n- Compare the installed Windows build against Microsoft's security update guide entry for this CVE: unknown from the sources.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["nfs-client-not-installed","no-local-untrusted-users"],"who_is_affected":"Only Windows machines where the Client for NFS component is in use can be hit, and the attacker must already be able to run code as an authorized local user. Machines without the NFS client feature enabled are likely not exposed, but the sources do not list the affected Windows versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":4494,"output_tokens":557,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-122165 to get affected Windows builds and the patch KB.","search":"'-122165':16A,19A '-2026':15A,18A '10/11':21A 'account':54B 'affect':71B 'allow':84C 'alreadi':51B 'and':22A 'attack':49B,87C 'author':86C 'base':38B,76C 'buffer':39B,77C 'build':73B 'client':2A,25A,44B,81C 'cve':14A,17A 'describ':65B 'elev':89C 'escal':32B 'exact':67B 'for':26A 'gain':11A 'heap':5A,37B,75C 'heap-bas':36B,74C 'higher':12A 'infrastructur':28B 'let':7A,47B 'local':9A,30B,91C 'local-privilege-escal':29B 'machin':57B 'nfs':4A,27A,33B,46B,83C 'overflow':6A,40B,78C 'privileg':13A,31B,60B,90C 'rais':58B 'server':24A 'sourc':62B 'trigger':68B 'user':10A 'window':1A,34B,43B,72B,80C 'windows':20A,23A","nicknames":[],"mitigations":[],"who_affected":"Windows 10, Windows 11 and Windows Server 2016 to 2025 builds below the fixed versions are listed by Microsoft as affected. An attacker needs a local low-privileged account and can gain SYSTEM. Shared workstations, terminal/RDS servers and build hosts with local users matter most; single-user machines with no untrusted code are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1011andwindowsserverclientfornfs","windows1011andwindowsserverclientfornfs"],"ptokens":["10","11","and","client","for","nfs","server","windows"],"labels":["high","infrastructure","localprivilegeescalation","nfs","windows"],"campaign_type":null,"search_a":"'-122165':16A,19A '-2026':15A,18A '10/11':21A 'and':22A 'client':2A,25A 'cve':14A,17A 'for':26A 'gain':11A 'heap':5A 'higher':12A 'let':7A 'local':9A 'nfs':4A,27A 'overflow':6A 'privileg':13A 'server':24A 'user':10A 'window':1A 'windows':20A,23A","search_b":"'account':54B 'affect':71B 'alreadi':51B 'attack':49B 'base':38B 'buffer':39B 'build':73B 'client':44B 'describ':65B 'escal':32B 'exact':67B 'heap':37B 'heap-bas':36B 'infrastructur':28B 'let':47B 'local':30B 'local-privilege-escal':29B 'machin':57B 'nfs':33B,46B 'overflow':40B 'privileg':31B,60B 'rais':58B 'sourc':62B 'trigger':68B 'window':34B,43B,72B","search_c":"'allow':84C 'attack':87C 'author':86C 'base':76C 'buffer':77C 'client':81C 'elev':89C 'heap':75C 'heap-bas':74C 'local':91C 'nfs':83C 'overflow':78C 'privileg':90C 'window':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122165","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122165","severity":null,"published_at":"2026-11-10T19:20:33+00:00","modified_at":"2026-11-10T19:20:33+00:00","first_seen_at":"2026-11-10T19:25:10+00:00","fetched_at":"2026-11-10T19:25:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122165:2840","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-122165","severity":null,"published_at":"2026-11-10T21:43:04+00:00","modified_at":"2026-11-10T21:43:04+00:00","first_seen_at":"2026-11-10T21:43:04+00:00","fetched_at":"2026-11-10T21:43:04+00:00","note":"MSRC record read (Important, 7.8, not exploited, not publicly disclosed, Exploitation Less Likely, SYSTEM on success). Fixed builds from Microsoft's CNA data in NVD. KB numbers not available from sources; web search not used. Not verified: MSRC page itself lists no builds in what I could read.","cites":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-122165","https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-122165"]}],"documents":[{"id":118980,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-122165","title":"MSRC: CVE-2026-122165 Windows Client for NFS Elevation of Privilege Vulnerability","kind":"advisory","source":"analyst","publisher":null,"text":"Microsoft Security Update Guide (API record), released 2026-11-10, 2026-Nov. Heap-based buffer overflow (CWE-122) in Windows Client for NFS allows an authorized attacker to elevate privileges locally. Severity Important, CVSS 7.8 (temporal 6.8, E:U/RL:O). Publicly disclosed: No. Exploited: No. Exploitability assessment: Exploitation Less Likely. Successful exploitation could give SYSTEM privileges. Customer action required.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":118981,"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-122165","title":"NVD record CVE-2026-122165 (Microsoft CNA affected builds)","kind":"other","source":"analyst","publisher":null,"text":"Affected data supplied by secure@microsoft.com; fixed at build: Win10 1607 / Server 2016 10.0.14393.9688; Win10 1809 / Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; Win11 25H2 10.0.26200.9974; Win11 26H1 10.0.28000.3501; Win11 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822.","published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}