Skip to main content

Severity by source

Vendor (microsoft) PRIMARY
HIGH
qualitative
NVD
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.1 HIGH

Network-reachable and unauthenticated with no interaction (AV:N/PR:N/UI:N), but a kernel use-after-free race gives AC:H; kernel-level RCE yields full C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Severity Changed
Jul 20, 2026 - 17:22 NVD
HIGH CRITICAL
CVSS changed
Jul 20, 2026 - 17:22 NVD
8.1 (HIGH) 9.8 (CRITICAL)
Analysis Generated
Jul 14, 2026 - 18:02 vuln.today
CVE Published
Jul 14, 2026 - 17:04 nvd
HIGH 8.1

DescriptionNVD

Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in the Windows Reliable Multicast Transport Driver (RMCAST) lets an unauthenticated network attacker trigger a use-after-free (CWE-416) and run arbitrary code on a broad range of Windows 10, Windows 11, and Windows Server systems (Server 2012 through Server 2025). Rated CVSS 8.1, the flaw carries high impact to confidentiality, integrity, and availability but requires winning a race condition (AC:H), and no public exploit identified at time of analysis. Reported by Microsoft with a vendor patch available.

Technical ContextAI

RMCAST is the Windows kernel-mode driver implementing Reliable Multicast / Pragmatic General Multicast (PGM), a transport used for one-to-many reliable data delivery over IP multicast. The root cause is CWE-416 (Use After Free): the driver continues to reference kernel heap memory after it has been freed, and an attacker who influences the timing of allocation/free operations while parsing multicast transport traffic can cause freed memory to be reused, corrupting kernel structures. Because RMCAST runs in kernel context, successful reuse of the dangling pointer can lead to arbitrary code execution at kernel privilege. The affected CPEs span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, indicating the vulnerable code is long-standing across the Windows networking stack.

RemediationAI

Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-54995 for your specific Windows or Windows Server build as listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54995, prioritizing internet- or untrusted-network-reachable hosts. Because RMCAST implements PGM reliable multicast, a strong compensating control where patching must be delayed is to block or restrict PGM/multicast traffic: filter IP protocol 113 (PGM) and the associated multicast group traffic at host and network firewalls, and disable the Windows PGM/RMCAST capability on hosts that do not require reliable multicast (note the side effect that any application depending on MSMQ multicast or PGM-based delivery will lose connectivity). Segmenting multicast to trusted VLANs limits exposure but does not remove risk from an attacker already inside that segment. These mitigations reduce reachability but are not a substitute for the vendor patch.

CVE-2026-33824 CRITICAL POC
9.8 Apr 14

Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen

CVE-2026-56155 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p

CVE-2026-32202 MEDIUM POC
4.3 Apr 14

Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n

CVE-2026-49798 CRITICAL POC
9.3 Jul 14

Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve

CVE-2026-54128 HIGH POC
8.4 Jul 14

Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff

CVE-2026-50518 CRITICAL
9.8 Jul 14

Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr

CVE-2026-50655 HIGH POC
7.8 Jul 14

Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug

CVE-2026-54992 HIGH POC
7.8 Jul 14

Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component

CVE-2026-50489 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem

CVE-2026-50667 HIGH POC
7.0 Jul 14

Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c

CVE-2026-57092 CRITICAL
9.9 Jul 14

Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating

CVE-2026-56190 CRITICAL
9.8 Jul 14

Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary

Share

CVE-2026-54995 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy