Windows RMCAST CVE-2026-69789

Exploitation requires the attacker to be on the same adjacent network (AV:A) as the target and requires the Reliable Multicast Transport Driver (RMCAST, which services PGM/reliable-multicast traffic) to be reachable and processing attacker-supplied multicast packets. Exploitation is unauthenticated (PR:N) and needs no user interaction (UI:N), but is materially limited by high attack complexity (AC:H): successful heap-overflow exploitation depends on specific memory-layout/heap-grooming conditions that cannot be reliably automated, consistent with SSVC Automatable:no. The adjacency requirement means internet-based, remote-unauthenticated mass exploitation is not possible - an attacker must first obtain a position on the local/broadcast or multicast-reachable network segment.

This is a moderate-priority vulnerability rather than a top-tier emergency, despite affecting ubiquitous Windows platforms. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 7.5) reflects total compromise potential (C:H/I:H/A:H) but is meaningfully constrained by two factors: the adjacent-network attack vector (AV:A) means the attacker must be on the same logical/physical network segment rather than exploiting across the open internet, and high attack complexity (AC:H) indicates that reliable heap-overflow exploitation requires overcoming non-trivial conditions such as memory-layout grooming. These constraints are strongly corroborated by CISA's SSVC decision framework, which rates Exploitation as 'none' (no observed or proof-of-concept activity) and Automatable as 'no' (cannot be reliably scripted/wormed at scale), even while confirming Technical Impact as 'total.' No EPSS score was provided in the input, and the CVE is NOT listed in CISA KEV; no public POC is referenced. The signals are therefore consistent rather than conflicting: a high-impact but hard-to-exploit, adjacency-limited, currently-unexploited flaw. The practical risk is targeted, skilled attacks against reachable network segments - not widespread automated exploitation. Priority should be driven by the ubiquity of Windows and the total-impact ceiling, moderated by the adjacency requirement and high complexity.

An attacker positioned on the same local/adjacent network segment as a vulnerable Windows host sends specially crafted Reliable Multicast (PGM/RMCAST) traffic that triggers a heap-based buffer overflow in the RMCAST driver. By carefully shaping heap memory, the attacker achieves arbitrary code execution in the context of the driver, leading to full system compromise. No public exploit identified at time of analysis, and the high attack complexity (AC:H) means reliable exploitation requires significant skill and favorable memory conditions.