Skip to content

CVE-2026-78445 Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability

CriticalCVSS 9.8 EPSS 0.97%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network.

Affected products

ProductAffected versionsFixed in
Microsoft Windows Server 2012 >= 6.2.9200.0, < 6.2.9200.26349 6.2.9200.26349
Microsoft Windows Server 2012 (Server Core installation) >= 6.2.9200.0, < 6.2.9200.26349 6.2.9200.26349
Microsoft Windows Server 2012 R2 >= 6.3.9600.0, < 6.3.9600.23398 6.3.9600.23398
Microsoft Windows Server 2012 R2 (Server Core installation) >= 6.3.9600.0, < 6.3.9600.23398 6.3.9600.23398
Microsoft Windows Server 2016 >= 10.0.14393.0, < 10.0.14393.9512 10.0.14393.9512
Microsoft Windows Server 2016 (Server Core installation) >= 10.0.14393.0, < 10.0.14393.9512 10.0.14393.9512
Microsoft Windows Server 2019 >= 10.0.17763.0, < 10.0.17763.9245 10.0.17763.9245
Microsoft Windows Server 2019 (Server Core installation) >= 10.0.17763.0, < 10.0.17763.9245 10.0.17763.9245
Microsoft Windows Server 2022 >= 10.0.20348.0, < 10.0.20348.5622 10.0.20348.5622
Microsoft Windows Server 2025 >= 10.0.26100.0, < 10.0.26100.33438 10.0.26100.33438
Microsoft Windows Server 2025 (Server Core installation) >= 10.0.26100.0, < 10.0.26100.33438 10.0.26100.33438
Microsoft Windows Server 2012 All versions No fix listed
Microsoft Windows Server 2012 = r2 No fix listed
Microsoft Windows Server 2016 < 10.0.14393.9512 10.0.14393.9512
Microsoft Windows Server 2019 < 10.0.17763.9245 10.0.17763.9245
Microsoft Windows Server 2022 < 10.0.20348.5622 10.0.20348.5622
Microsoft Windows Server 2025 < 10.0.26100.33438 10.0.26100.33438
Microsoft Windows Server 2012 < 6.2.9200.26349 6.2.9200.26349
Microsoft Windows Server 2012 R2 < 6.3.9600.23398 6.3.9600.23398

References