EUVD-2026-44015
GHSA-mhhw-8j27-mg72
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent-network multicast driver flaw, unauthenticated and no interaction with low complexity (AV:A/AC:L/PR:N/UI:N); kernel code execution yields full C/I/A impact within an unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer underflow (wrap or wraparound) in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.
AnalysisAI
Remote code execution in the Windows Reliable Multicast Transport Driver (RMCAST) lets an unauthenticated attacker on the same network segment run arbitrary code by triggering an integer underflow (CWE-191) during multicast message processing. All supported Windows client and server builds from Windows Server 2012 through Windows Server 2025 and Windows 10 1607 through Windows 11 26H1 are affected. There is no public exploit identified at time of analysis, but the CVSS 8.8 adjacent-network unauthenticated profile and Microsoft's own reporting make this a high-priority patch.
Technical ContextAI
RMCAST is the kernel-mode driver behind Windows' implementation of PGM (Pragmatic General Multicast), a reliable multicast transport used by MSMQ (Message Queuing) and other multicast-based messaging over UDP. The flaw is CWE-191 Integer Underflow (wrap/wraparound): a length or offset field in an inbound multicast packet is subtracted below zero, wrapping to a very large unsigned value that drives an out-of-bounds memory operation, corrupting kernel memory and enabling code execution. Because the vulnerable code runs in the network-facing driver, exploitation happens without user interaction. The CPE set (cpe:2.3:a:microsoft:windows_10_version_1607 through windows_11_version_26h1, plus windows_server_2012/2012_r2 and, per the tags, Server 2016/2019/2022/2025) confirms the driver ships across essentially the entire supported Windows fleet.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-54982 from the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54982) to every affected client and server SKU, including Server Core; consult that page for the exact KB/build number for each Windows version, as an exact fix version was not included in the supplied data. Where patching must be staged, the practical compensating control is to reduce exposure to inbound PGM multicast: if MSMQ/PGM multicast is not required, disable the Message Queuing role/feature or the RMCAST-dependent services, and block PGM traffic (IP protocol 113 and the associated multicast UDP) at network boundaries and host firewalls so only trusted segments can reach the driver - the trade-off is that legitimate multicast messaging applications will lose connectivity, so validate MSMQ dependencies before disabling. Because the vector is adjacent-network, network segmentation (isolating servers into restricted VLANs) also meaningfully limits which hosts can attempt exploitation.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-191 – Integer Underflow
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today