CVE-2026-71334

CVE-2026-71334 is a heap-based buffer overflow (CWE-122) in the NFS Portmapper component of Microsoft Windows. An attacker who already has authorized low-privileged access on the local system can trigger the flaw through the NFS Portmapper service and elevate their privileges, with high impact on confidentiality, integrity, and availability per the CVSS score of 7.8 (High). The issue only affects Windows systems where the NFS interoperability components (Services for NFS, which include the Portmapper) are installed and enabled, which is an optional feature rather than a default Windows configuration. As of now there is no known exploitation: the flaw is not in CISA's KEV, no public proof-of-concept exists, and EPSS assigns only a 0.2% probability of exploitation within 30 days.

What to do: Apply the Microsoft security update for CVE-2026-71334 as directed in Microsoft's advisory, delivered through Windows Update/WSUS. On systems that do not require NFS interoperability, remove the Services for NFS optional feature (NFS client/server) to eliminate exposure entirely. Where the NFS components must remain enabled, limit local sign-in rights to trusted users, since exploitation requires an authorized local account.