CVE-2026-83989

CVE-2026-83989 is an out-of-bounds read (CWE-125) in the ONCRPC XDR driver of Microsoft's Windows Services for NFS, addressed in Microsoft's September 2026 Patch Tuesday release. A remote, unauthenticated attacker can trigger it by sending crafted ONC RPC/XDR network requests to a host running the NFS service, causing the driver to read past the end of an allocated buffer. Successful exploitation crashes the NFS service, yielding denial of service only; the CVSS vector (C:N/I:N/A:H) confirms there is no data disclosure or tampering impact. Any Windows system with Services for NFS installed and enabled is affected, but practical exposure is limited to environments that actually use this optional feature, particularly where the NFS service is reachable from untrusted networks. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns a 0.9% 30-day exploitation probability (57th percentile), so no active exploitation is currently reported.

What to do: Apply the September 2026 Patch Tuesday security updates from Microsoft on any Windows systems with Services for NFS installed, checking Microsoft's advisory for the affected Windows versions and fixed builds. Inventory systems for the NFS feature/role and confirm whether the NFS/ONC RPC service is reachable from untrusted networks, restricting access with firewall rules or trusted-subnet limits where patching is delayed. Continue monitoring Microsoft's advisory and CISA KEV, since no public PoC or in-the-wild exploitation is known as of this analysis.