Windows RMCAST CVE-2026-78450

The RMCAST/PGM Windows feature must be explicitly installed and active on the target system - this is an optional component not present in default Windows Server installations, requiring deliberate installation via Add Roles and Features or equivalent. The attacker must have network-level access sufficient to reach the RMCAST service, which processes PGM multicast packets (IP protocol 113). Per the CVSS vector (PR:N/UI:N), no credentials or user interaction are required once network reachability is established. The AC:H rating indicates that reliable exploitation additionally requires precise race-condition timing or heap grooming, limiting opportunistic and fully automated exploitation. Systems where RMCAST is not installed, or where PGM traffic is blocked by perimeter or host-based firewall rules, cannot be exploited via this vulnerability.

The CVSS 8.1 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a high-severity unauthenticated network-exploitable kernel UAF - a class historically capable of yielding SYSTEM-level code execution on Windows. The AC:H metric acknowledges the race-condition timing or heap-shaping complexity inherent to kernel UAF exploitation, which meaningfully reduces the likelihood of reliable automated exploitation by unsophisticated actors. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. EPSS data was not included in the source intelligence, precluding probabilistic exploitation-rate comparison. The 'Denial Of Service' input tag understates the true impact - the vendor description explicitly states code execution and the full CVSS triad (C:H/I:H/A:H) confirms arbitrary code execution as the primary consequence. Real-world exposure is highest on Windows Server environments where the RMCAST/PGM feature is actively installed and reachable from untrusted network segments; organizations that do not use PGM multicast or that block multicast traffic at the perimeter face meaningfully lower operational risk despite the 8.1 base score.

An unauthenticated attacker with network access to a Windows Server running the RMCAST driver sends specially crafted PGM multicast packets timed to trigger a race condition, causing the kernel-mode driver to dereference a previously freed memory region. By pre-shaping the kernel heap to place attacker-controlled data at the freed address, the attacker redirects execution flow within kernel space and executes arbitrary code at SYSTEM privilege. No public exploit code is known to exist at time of analysis, and the AC:H rating indicates that reliable exploitation requires advanced kernel heap manipulation techniques.