The Microsoft Qlib _mount_nfs_uri function contains a command injection vulnerability that permits remote code execution by network-adjacent attackers without requiring authentication. The vulnerability arises from insufficient validation of user input before it is used in a system call, enabling attackers to execute arbitrary commands with root privileges. This issue has been assigned a CVSS score of 8.8 by the Zero Day Initiative. The vulnerability was reported to Microsoft on May 22, 2025, and a patch was released on May 31, 2025. The advisory was publicly released on April 15, 2026.

Successful exploitation allows an attacker to execute arbitrary code with root privileges on affected Microsoft Qlib installations. This can lead to full system compromise, including confidentiality, integrity, and availability impacts. No authentication is required, increasing the risk of exploitation by network-adjacent attackers.

An official patch addressing this vulnerability was released by Microsoft on May 31, 2025. Users and administrators should apply this update immediately to remediate the issue. Since this is not a cloud service, remediation depends on applying the vendor-provided fix. No additional mitigation steps are indicated in the advisory.