Windows RMCAST CVE-2026-62816

Exploitation requires the attacker to occupy an adjacent network position - specifically the same LAN broadcast domain, VLAN, or a subnet reachable via IP multicast routing - as the vulnerable Windows host; direct internet-based exploitation is not possible unless multicast routing is deliberately configured to forward PGM traffic to the target, which is non-default. The RMCAST driver must be installed and processing PGM multicast traffic on the target system; disabling or uninstalling the Pragmatic General Multicast feature eliminates the attack surface. Per the confirmed CVSS vector (PR:N, UI:N), no authentication and no user interaction are required. There are no edition-specific limitations - all affected Windows desktop and server SKUs within the listed build ranges are equally exposed.

The CVSS 8.8 score is well-supported by the attacker-favorable combination of no required privileges, no user interaction, low attack complexity, and full confidentiality, integrity, and availability impact. The primary limiting factor is the adjacent-network vector (AV:A), which excludes direct internet exploitation unless multicast routing is explicitly configured to forward PGM traffic to the target - a non-default scenario. However, internal enterprise networks, cloud VNet peerings, shared hosting environments, and flat VLAN segments all fall within the exploitable perimeter; even a mid-sized municipal IT team in boleslawiec should treat this as urgent given how routinely Windows Server hosts coexist on flat LAN segments with other managed devices. No EPSS data was supplied in the source intelligence, and the absence of a KEV listing indicates CISA has not confirmed widespread active exploitation at time of analysis. No public proof-of-concept code is noted, but the low attack complexity rating implies the overflow is reliably triggerable without requiring fragile race conditions or precise heap layout manipulation, making it tractable for skilled threat actors. The full C:H/I:H/A:H triad confirms complete system compromise upon successful exploitation.

An attacker with a foothold on the same LAN segment, VLAN, or multicast-routed subnet as a vulnerable Windows host crafts malformed PGM protocol data units and transmits them to the target multicast address without supplying any credentials. The oversized or structurally invalid payload overflows a heap-allocated buffer inside the RMCAST kernel driver, corrupting adjacent heap control structures or function pointers and diverting execution to attacker-controlled code running at kernel privilege. No public exploit has been identified at time of analysis, but the low attack complexity rating indicates the overflow is reliably triggerable without specialized heap grooming or race condition exploitation.