Microsoft Windows CVE-2026-54995

Exploitation requires the target Windows host to have the Reliable Multicast Transport Driver (RMCAST/PGM) active and reachable so the attacker can deliver crafted multicast transport packets - PGM reliable multicast is not enabled in default Windows configurations and is typically present only where applications such as MSMQ multicast are in use, which sharply limits the exposed population. Per CVSS PR:N/UI:N, no authentication or user interaction is needed, but AC:H means the attacker must reliably win a use-after-free race condition in the kernel, a meaningful limiting factor. Additional limits: the attacker must have network reachability to the multicast-listening interface (commonly the same L2 segment/multicast domain rather than the open internet), and only the enumerated Windows 10/11 and Server 2012-2025 builds are affected.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.1) describes a network-reachable, unauthenticated, no-interaction bug with full CIA impact, but the High attack complexity is the key tempering factor: reliably winning the use-after-free race and defeating kernel mitigations (KASLR, heap hardening) is non-trivial, which is why the score is 8.1 rather than 9.8. No CISA KEV listing and no public exploit identified at time of analysis, and no EPSS value was supplied, so there is no evidence of active exploitation or automated weaponization today. The realistic risk is elevated by ubiquity of Windows and the unauthenticated network vector, but constrained by AC:H and the fact that RMCAST/PGM is not enabled or exposed by default in most environments. Missing signals to note: EPSS score not provided, SSVC decision not provided, and exact patched build numbers not present in the supplied data - verify against the MSRC advisory.

An attacker on a network segment where a Windows host has RMCAST/PGM listening sends a crafted sequence of reliable-multicast transport packets designed to force the driver to free a buffer that is still referenced, then races to reallocate that freed kernel memory with attacker-controlled data. Winning the race (AC:H) lets the dangling pointer be dereferenced into attacker content, yielding kernel-level code execution without authentication or user interaction. No public exploit identified at time of analysis, so this scenario is currently theoretical rather than demonstrated.