Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated with no interaction (AV:N/PR:N/UI:N), but a kernel use-after-free race gives AC:H; kernel-level RCE yields full C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in the Windows Reliable Multicast Transport Driver (RMCAST) lets an unauthenticated network attacker trigger a use-after-free (CWE-416) and run arbitrary code on a broad range of Windows 10, Windows 11, and Windows Server systems (Server 2012 through Server 2025). Rated CVSS 8.1, the flaw carries high impact to confidentiality, integrity, and availability but requires winning a race condition (AC:H), and no public exploit identified at time of analysis. Reported by Microsoft with a vendor patch available.
Technical ContextAI
RMCAST is the Windows kernel-mode driver implementing Reliable Multicast / Pragmatic General Multicast (PGM), a transport used for one-to-many reliable data delivery over IP multicast. The root cause is CWE-416 (Use After Free): the driver continues to reference kernel heap memory after it has been freed, and an attacker who influences the timing of allocation/free operations while parsing multicast transport traffic can cause freed memory to be reused, corrupting kernel structures. Because RMCAST runs in kernel context, successful reuse of the dangling pointer can lead to arbitrary code execution at kernel privilege. The affected CPEs span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, indicating the vulnerable code is long-standing across the Windows networking stack.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-54995 for your specific Windows or Windows Server build as listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54995, prioritizing internet- or untrusted-network-reachable hosts. Because RMCAST implements PGM reliable multicast, a strong compensating control where patching must be delayed is to block or restrict PGM/multicast traffic: filter IP protocol 113 (PGM) and the associated multicast group traffic at host and network firewalls, and disable the Windows PGM/RMCAST capability on hosts that do not require reliable multicast (note the side effect that any application depending on MSMQ multicast or PGM-based delivery will lose connectivity). Segmenting multicast to trusted VLANs limits exposure but does not remove risk from an attacker already inside that segment. These mitigations reduce reachability but are not a substitute for the vendor patch.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-44022
GHSA-w75j-4mxv-mw59