Microsoft Windows CVE-2026-54982

Exploitation requires network adjacency (AV:A) - the attacker must be able to send multicast/PGM packets to the target on the same broadcast domain, VLAN, or subnet, not from an arbitrary internet host - and the target must have the RMCAST/PGM multicast path reachable, which in practice means Message Queuing (MSMQ) or another PGM-based service is installed and listening. No authentication (PR:N) and no user interaction (UI:N) are needed, and attack complexity is low (AC:L), so against a reachable, MSMQ/PGM-enabled Windows host on the local segment there are no further prerequisites. The main limiting factors are the adjacent-network constraint and the requirement that the RMCAST-dependent service actually be enabled - hosts without PGM multicast messaging exposed present a much smaller attack surface.

The signals are mostly consistent and point to a genuine priority. CVSS 8.8 with AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:H means adjacent-network, low-complexity, unauthenticated code execution with full impact - the only limiter versus a perfect 9.8/10.0 is that the attacker must reach the target over an adjacent (same-segment/broadcast) network rather than routed internet. No EPSS score, no KEV entry, and no POC were supplied, so exploitation is not confirmed active; the realistic risk is elevated-but-not-emergency: highly attractive for lateral movement once an attacker has a foothold on a LAN, VLAN, or cloud subnet, especially where MSMQ/PGM multicast is enabled. One data caveat: the vendor Tags list 'Authentication Bypass' alongside 'Integer Overflow', which conflicts with the CWE-191 (underflow) root cause in the description - treat the 'Authentication Bypass' tag as unverified metadata and rely on the memory-corruption RCE described by NVD/Microsoft.

An attacker who has gained a foothold on the same LAN or VLAN as a Windows server sends crafted PGM multicast packets to the RMCAST driver, triggering the integer underflow and executing code in the kernel network context without any credentials or user interaction. This is a strong lateral-movement and privilege-gaining primitive after initial access to a subnet; no public POC was identified at time of analysis, so exploitation would currently require original research.